Static task
static1
Behavioral task
behavioral1
Sample
aa1c1729217bf1ba045c15686e57d6b6_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
aa1c1729217bf1ba045c15686e57d6b6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
aa1c1729217bf1ba045c15686e57d6b6_JaffaCakes118
-
Size
11KB
-
MD5
aa1c1729217bf1ba045c15686e57d6b6
-
SHA1
3ede57feef66e4eb8703de759264e374754531d0
-
SHA256
790a74b99654df65259504393a030644ca0c41f85baab9b47697e1eb83065b05
-
SHA512
3444c4b48704e08da530a7f97c8f488ed4125b31162320f2788eb51eab8925fa0a24c3e1fd8db4a52feca3dbe41a6b5bb4a5424f10355b1ae8e703940aaf9db2
-
SSDEEP
192:eQmlfiPUTcRwl8NPkhPD9QDUMnRpJj5ZKoilLdsVdnnnnnkYQ9RzYsQirnnnnnG/:XqvWwl8opQDz5ZK/OeVisq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa1c1729217bf1ba045c15686e57d6b6_JaffaCakes118
Files
-
aa1c1729217bf1ba045c15686e57d6b6_JaffaCakes118.exe windows:4 windows x86 arch:x86
ad46298a1d1ee852e46063167b4297b6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
_snprintf
ZwCreateSection
RtlImageNtHeader
ZwOpenSection
ZwMakeTemporaryObject
RtlInitUnicodeString
ZwCreateSymbolicLinkObject
strncmp
memset
ZwOpenEvent
RtlImageDirectoryEntryToData
strstr
shell32
ShellExecuteA
kernel32
GetCommandLineA
GetModuleFileNameA
GetTempPathA
GetModuleHandleA
CloseHandle
VirtualFree
VirtualAlloc
GetCurrentProcess
CreateProcessA
GetVersionExA
ExitProcess
FindClose
FindNextFileA
MoveFileExA
FindFirstFileA
DeleteFileA
Sleep
MultiByteToWideChar
FlushFileBuffers
SetFilePointer
LoadLibraryExA
LoadLibraryA
CopyFileA
WriteFile
CreateFileA
GetTempFileNameA
advapi32
OpenSCManagerA
OpenServiceA
ControlService
QueryServiceStatusEx
StartServiceA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
Sections
.text Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE