Static task
static1
Behavioral task
behavioral1
Sample
ba7fac48d22d4541b7c13cf1294347e7_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ba7fac48d22d4541b7c13cf1294347e7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ba7fac48d22d4541b7c13cf1294347e7_JaffaCakes118
-
Size
244KB
-
MD5
ba7fac48d22d4541b7c13cf1294347e7
-
SHA1
824191cd86e6a8233e56fc63d173d11fd3fed684
-
SHA256
318c31891aebadf65c94af514e3fc13ad8eb873ed4722f3d2d23869cf88b9a93
-
SHA512
f1e7b5836020181c0b0cb1db888334ea652129e3ec34d88f9fa331fbefc6ef5bd529e18ce292541a0fe7daec456fc3202027899302345b593633eadb52caa7ae
-
SSDEEP
3072:L1KTV9DlT/gQcd8CFYz4lcNPzdWBlXSZ9Ysz+N5jWvQ8bPjvtSpYxjFtNSM8Vs1I:gTz3GXOXoXw9YsKjWFbj/NSm1LGt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba7fac48d22d4541b7c13cf1294347e7_JaffaCakes118
Files
-
ba7fac48d22d4541b7c13cf1294347e7_JaffaCakes118.exe windows:4 windows x86 arch:x86
0480a155f28743e39420036f688c9ad3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
FreeLibrary
GetLocalTime
lstrcpyA
GetModuleHandleA
GetProcAddress
LoadLibraryA
lstrcmpA
GetCommandLineA
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
GetStartupInfoA
ExitProcess
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
GetSystemInfo
Sections
.text Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 200KB - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ