Static task
static1
Behavioral task
behavioral1
Sample
b10795a261163a98dbefe2c5f0196497_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b10795a261163a98dbefe2c5f0196497_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b10795a261163a98dbefe2c5f0196497_JaffaCakes118
-
Size
129KB
-
MD5
b10795a261163a98dbefe2c5f0196497
-
SHA1
39fb1dcdc5c79077ba7ddf8fdd92e3c48bd25495
-
SHA256
e8caf237362fa43cd2b50d770871ec3170b26ba7bb76142418b467709d5b1331
-
SHA512
546280a4a870d7483894263fce4e297e98380ecfb96abd9c96fd5093eb1afce96f34cffa57f35c12ec869fb3b7dbe797b70044798d6474e8fe655749e12635ff
-
SSDEEP
1536:RmBe9yvjbgs9mfKT1n5Ic7MeTG7qwXlGkusTF0cv3OkfBj6xnTSMDuC+oUshSryQ:RMe6k0GcpTOTF0keWBj6AMDuC+oxSrye
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b10795a261163a98dbefe2c5f0196497_JaffaCakes118
Files
-
b10795a261163a98dbefe2c5f0196497_JaffaCakes118.exe windows:4 windows x86 arch:x86
39245399789bb7087aebaa4401b61611
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualQueryEx
GetThreadContext
GetProcAddress
LoadLibraryW
SetThreadContext
WriteProcessMemory
VirtualAllocEx
VirtualAlloc
GetModuleFileNameW
lstrlenW
GetModuleFileNameA
lstrcpyA
CloseHandle
ReleaseMutex
GetLastError
CreateMutexA
ExitProcess
CreateThread
GetModuleHandleW
GetModuleHandleA
FreeResource
lstrlenA
WriteFile
SizeofResource
CreateFileW
LoadResource
FindResourceW
Process32NextW
GlobalFree
lstrcmpiW
Process32FirstW
CreateToolhelp32Snapshot
GlobalAlloc
GetSystemDirectoryW
lstrcatW
GetTickCount
HeapFree
HeapAlloc
GetProcessHeap
LoadLibraryA
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
msvcrt
wcsstr
strstr
strchr
_except_handler3
realloc
malloc
fclose
fseek
ftell
fread
??2@YAPAXI@Z
fopen
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
xiaohutu Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ