Static task
static1
Behavioral task
behavioral1
Sample
ae75d3aeb61ea859625c4ad2cf9148f1_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ae75d3aeb61ea859625c4ad2cf9148f1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ae75d3aeb61ea859625c4ad2cf9148f1_JaffaCakes118
-
Size
39KB
-
MD5
ae75d3aeb61ea859625c4ad2cf9148f1
-
SHA1
1c9fc200a818fa4458f602f08f537897f5d86562
-
SHA256
4c354705b1b64ecc749a6c5be1e78d1ba254d2a005b248c2266ea9afa12fac23
-
SHA512
bd68a393e17ec6a7065472f4c67c785220eb28f5b4f1d30aa101f15516b538f5620f992b8e1b01db81648546c489e074cfa02cafcfdb11bdba786925826f48f0
-
SSDEEP
768:7QgvtmeaXM64s9TorB1qv4gfMFkvS1Syg1zDSDS8mnCOJIt4nocqZCywI0spkpoP:7QgvtnaXM64s9TorB1qv4gfMFkvS1SZA
Malware Config
Signatures
Files
-
ae75d3aeb61ea859625c4ad2cf9148f1_JaffaCakes118.exe windows:4 windows x86 arch:x86
4e44f149e2f66747fc19271bde35871e
Code Sign
76:79:2b:58:0c:c2:cf:a2:4e:03:f2:1a:a2:35:22:7aCertificate
IssuerCN=Root AgencyNot Before17-08-2012 10:44Not After31-12-2039 23:59SubjectCN=safebrowsing.mozilla.org79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01-05-2012 00:00Not After31-12-2012 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
d3:45:d5:f0:9c:c2:0e:20:ba:c2:4e:68:cc:79:84:47:9a:be:05:56Signer
Actual PE Digestd3:45:d5:f0:9c:c2:0e:20:ba:c2:4e:68:cc:79:84:47:9a:be:05:56Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWindowsDirectoryA
GetFileSize
CreateFileA
ResumeThread
GetProcAddress
VirtualAlloc
VirtualFree
LoadLibraryA
LocalFree
LocalAlloc
VirtualProtect
MapViewOfFile
CreateFileMappingA
ExitThread
ReadFile
winhttp
WinHttpSetStatusCallback
WinHttpOpen
WinHttpCloseHandle
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 610B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ