Static task
static1
Behavioral task
behavioral1
Sample
b528e19b639ea8f0be02ea070f666163_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b528e19b639ea8f0be02ea070f666163_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b528e19b639ea8f0be02ea070f666163_JaffaCakes118
-
Size
46KB
-
MD5
b528e19b639ea8f0be02ea070f666163
-
SHA1
eddc4e89ba86630d52491151d24208a1abdd1059
-
SHA256
b7a3f3c8ad2b1234463d53a907af2ac30a97e2e471dc9be56ff0722b26618f8d
-
SHA512
1258ef57db52d13f35d29982692780d50c6129f63c3a589dfe0b0b2800de253ba94364c9a37b3e567baa41894802d9b6174b3225e7b7644481cbcfe8b5a56746
-
SSDEEP
768:38TN+uew8SNmI6lDqQf+kwznvenS4dItOZGrkAWfUZWIE4Da+Dsx:38x+em3lDqDlnven+OZ7AZWr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b528e19b639ea8f0be02ea070f666163_JaffaCakes118
Files
-
b528e19b639ea8f0be02ea070f666163_JaffaCakes118.exe windows:5 windows x86 arch:x86
3cb316c53b2d8d91c5c9caf5d57abc52
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptGetHashParam
CryptReleaseContext
RegDeleteValueA
DuplicateTokenEx
RegQueryValueExA
CryptCreateHash
RegCloseKey
shlwapi
PathFileExistsW
PathCombineW
StrStrW
PathRemoveFileSpecW
SHDeleteKeyA
PathFindFileNameW
wvnsprintfA
StrCmpNIW
StrCmpNIA
wvnsprintfW
PathMatchSpecW
wnsprintfA
wnsprintfW
Sections
.elij Size: 36KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.jaf Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kfmjij Size: 5KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ