Static task
static1
Behavioral task
behavioral1
Sample
bda4a7fd20a8924f9bab34cbc50f751e_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bda4a7fd20a8924f9bab34cbc50f751e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bda4a7fd20a8924f9bab34cbc50f751e_JaffaCakes118
-
Size
171KB
-
MD5
bda4a7fd20a8924f9bab34cbc50f751e
-
SHA1
03bd79d7f15026c850c7c74a783e4c827109995b
-
SHA256
1c3d532a1104261278954596332db52b78e31a0930d17476d90c6ca0492dda1b
-
SHA512
a3e18c03f6f08497d5ee4f01d4bc33975a9cbbfdeb1621f69eb9166c4a76ea56af223e4a053881097c84e87b1ae100fc4c2f4f4c72f213dfeb55b598c1ca1783
-
SSDEEP
3072:/ecHw3A139r3aslaYL0xm6waaCMvu9aWtDPotYeWiXv/Bdf8L95irNdNf5z+zcQF:Ge/r3zaZmPC8uBBeTXv/T20rNvozx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bda4a7fd20a8924f9bab34cbc50f751e_JaffaCakes118
Files
-
bda4a7fd20a8924f9bab34cbc50f751e_JaffaCakes118.exe windows:4 windows x86 arch:x86
86e6bcc687ff28ae4b508b02b1bf9bd8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
CharNextA
TranslateMessage
PostQuitMessage
PeekMessageA
DispatchMessageA
MessageBoxA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32
SysFreeString
SysReAllocStringLen
kernel32.dll.
Sleep
LoadLibraryA
GetTickCount
GetProcAddress
GetLastError
ExitProcess
Sections
CODE Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ