Static task
static1
Behavioral task
behavioral1
Sample
ab4799ef5cfdc4768e6d8a34f89c71f4_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ab4799ef5cfdc4768e6d8a34f89c71f4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ab4799ef5cfdc4768e6d8a34f89c71f4_JaffaCakes118
-
Size
289KB
-
MD5
ab4799ef5cfdc4768e6d8a34f89c71f4
-
SHA1
c740c372e0f27dcd9f6a868be6928a2c1c6f219d
-
SHA256
edd03b3cbdb03e30a67e0f573947ad251907c8fc51f1cd4d625e09502c9696b0
-
SHA512
e01a5cd81eb7590a12cf3b291a8cd1062abb26cc9c78371a3323d53a779be06f351df0791b1cc0e4cb8aae01affce876a06c664b39ab9e81c872ab82c1097704
-
SSDEEP
6144:eBX2MxXOs/eOIEqzI51bc7X5tDTepJMVNbqbyHhHzBx81yIC:eVBB/Bx151ytDCpnbyBTBeNC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ab4799ef5cfdc4768e6d8a34f89c71f4_JaffaCakes118
Files
-
ab4799ef5cfdc4768e6d8a34f89c71f4_JaffaCakes118.exe windows:4 windows x86 arch:x86
13a380d0688da8583f34506e346ea449
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
CompareStringA
GetCurrentProcessId
ReleaseSemaphore
DeleteAtom
GetStdHandle
DeviceIoControl
SetFilePointer
GetConsoleMode
GetModuleHandleA
FreeLibrary
user32
SendMessageA
Sections
qWdoysWw Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
RwnPlgBW Size: 1024B - Virtual size: 666B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
HXvRmyDQ Size: 259KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE