Static task
static1
Behavioral task
behavioral1
Sample
a581d11eeb04956cb6de4958201aac1c_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a581d11eeb04956cb6de4958201aac1c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a581d11eeb04956cb6de4958201aac1c_JaffaCakes118
-
Size
35KB
-
MD5
a581d11eeb04956cb6de4958201aac1c
-
SHA1
f83b850c0b54b16a66d8af708f3ea2353efeb707
-
SHA256
166f338df0a5bed1f0163ea3226a1d7c6ce295971e57ad0c71da74a0a27a539f
-
SHA512
231f6bc25bbf871520bce1f742306d3c449347b668ee2bb8a30e19fbcda27142bbb2b2aed54d2118a8e748c73c813615952f20ae275939c41b28e4dc3f22bf72
-
SSDEEP
384:YBpoY0LNIx02yt5gDy1/9WIwh7vzRZZfZYFJb5ce0Vv25fklTxoaR0jxlp:Y702a7TggkIG7v9ZED5cewvRlTybB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a581d11eeb04956cb6de4958201aac1c_JaffaCakes118
Files
-
a581d11eeb04956cb6de4958201aac1c_JaffaCakes118.exe windows:4 windows x86 arch:x86
52a8e81a7ca313396ea9bc1bcb041681
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
GetProcAddress
LoadLibraryA
GetTickCount
GetSystemDirectoryA
GetTempPathA
CloseHandle
WriteFile
CreateFileA
GetModuleFileNameA
MoveFileA
GetSystemInfo
GetVersionExA
FreeLibrary
FreeResource
SizeofResource
LoadResource
GetCurrentThreadId
GetStartupInfoA
GetModuleHandleA
Sleep
GetCurrentDirectoryA
ExitProcess
user32
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
GetInputState
PostThreadMessageA
GetMessageA
wsprintfA
FindWindowA
PostMessageA
OpenWindowStationA
shell32
ShellExecuteA
msvcrt
_except_handler3
__set_app_type
__p__fmode
__p__commode
_strrev
_adjust_fdiv
_controlfp
__setusermatherr
_initterm
strcpy
strlen
memset
sprintf
??3@YAXPAX@Z
memcpy
??2@YAPAXI@Z
_exit
_XcptFilter
exit
_acmdln
__getmainargs
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_win Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE