Static task
static1
Behavioral task
behavioral1
Sample
a5bd72e9f6f97ac3a0750699d3432e90_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a5bd72e9f6f97ac3a0750699d3432e90_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a5bd72e9f6f97ac3a0750699d3432e90_JaffaCakes118
-
Size
278KB
-
MD5
a5bd72e9f6f97ac3a0750699d3432e90
-
SHA1
5bbe9841a8f30f8240b4d6cbb2b50773e98e9e4d
-
SHA256
9babc798e91cf0ad1f9a355137cfcd70bdb28480a7d18075629d2b144d15b03b
-
SHA512
9fcc113674e2080964f6b24b032b84ba29a59632823559e2e85c8931d472baa13e84769700c323a5d95d844ebc421921ce2e4522779936d0f1f9410254d88aea
-
SSDEEP
3072:1itn1K57HjhQn2wD4VBEIGumnSnMtvyoRLHDB/eR9jaO3OZvH8OU2YFLhNL9bD3f:e1gjS4FcSnoya3oWXzY1LRKtEFx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a5bd72e9f6f97ac3a0750699d3432e90_JaffaCakes118
Files
-
a5bd72e9f6f97ac3a0750699d3432e90_JaffaCakes118.exe windows:5 windows x86 arch:x86
f903d98eea40e427c175ab2877e3c08f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
fmifs
Format
FormatEx
EnableVolumeCompression
DiskCopy
Extend
Chkdsk
kernel32
GetSystemTimeAsFileTime
lstrcmpA
IsValidLocale
CloseHandle
GetLocalTime
GetProcessHeap
CreateFileA
MultiByteToWideChar
GetCurrentProcess
QueryPerformanceCounter
GetCurrentProcessId
GetUserDefaultLCID
HeapFree
SetLastError
lstrcpyW
GetTickCount
WideCharToMultiByte
SetUnhandledExceptionFilter
GetSystemDefaultLangID
SystemTimeToFileTime
HeapAlloc
LoadLibraryA
w32topl
ToplSTHeapDestroy
ToplScheduleDuration
ToplScheduleCacheDestroy
ToplSTHeapExtractMin
ToplScheduleExportReadonly
ToplScheduleCacheCreate
ToplSTHeapInit
ToplScheduleCreate
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 247KB - Virtual size: 258KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ