Static task
static1
Behavioral task
behavioral1
Sample
ab5934ef4266217dae02a2dcb5fba8f1_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ab5934ef4266217dae02a2dcb5fba8f1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ab5934ef4266217dae02a2dcb5fba8f1_JaffaCakes118
-
Size
140KB
-
MD5
ab5934ef4266217dae02a2dcb5fba8f1
-
SHA1
2e8fb91d497d3b4f20b8ae7c5205c666c81855e5
-
SHA256
7f7fbf801d961c40ecbac00c8221e90752e557be24c3c6f46ea6189fa093f6d8
-
SHA512
9f3404b125b6912258a5e799f57b935cf77b63ff26273a399a42fa591968dcd5942b98a2dc6a2d24745dd0385c099bfd84d9d31ee6600e0f77db5823cab1ffd5
-
SSDEEP
3072:YTSjO9/gV8nkJP0tADBDxc8I495hkTl4zeYmDF1B:uyO9/gV11sA95aTl2eYmDt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ab5934ef4266217dae02a2dcb5fba8f1_JaffaCakes118
Files
-
ab5934ef4266217dae02a2dcb5fba8f1_JaffaCakes118.exe windows:4 windows x86 arch:x86
0020790365ec6dbb78e315eb37936346
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winhttp
WinHttpOpen
WinHttpReceiveResponse
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpCheckPlatform
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WinHttpSendRequest
WinHttpOpenRequest
WinHttpQueryAuthSchemes
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpQueryOption
xolehlp
DtcGetTransactionManagerExA
ord7
kernel32
WideCharToMultiByte
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
VirtualAlloc
WriteFile
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
GetModuleHandleA
InitializeCriticalSection
EnterCriticalSection
WriteConsoleW
lstrcmpA
GetWindowsDirectoryA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
HeapAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 552KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ