Static task
static1
Behavioral task
behavioral1
Sample
be6a3f66cdb8841cbe94e9b46acdf1f7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
be6a3f66cdb8841cbe94e9b46acdf1f7_JaffaCakes118
-
Size
49KB
-
MD5
be6a3f66cdb8841cbe94e9b46acdf1f7
-
SHA1
8dd1761ca7e62ff9f914d57ed925344a5cddc22e
-
SHA256
4cdae369230f52cbe0a3fafa6b42aef198bb9ecf36a5f815307ba298b1e206cb
-
SHA512
7abdb681c24ac7ab3fc357d8c52c8c15154d9d2f02ddba9448d4abb29550bef389e5f29864f54006c6fe544c2f3bfd9d6ce85ff6ee3b2db75f1e5b14f8adbbcd
-
SSDEEP
1536:4pIwRwL5WePHBLZ4Mf/10xlzIksOxIOfYhR:4pRRKce5lxH10PzNAR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be6a3f66cdb8841cbe94e9b46acdf1f7_JaffaCakes118
Files
-
be6a3f66cdb8841cbe94e9b46acdf1f7_JaffaCakes118.exe windows:10 windows x86 arch:x86
63c38c4dddb8db13de7401c14a824d43
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-private-l1-1-0
memcmp
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-synch-l1-1-0
SetEvent
api-ms-win-core-errorhandling-l1-1-0
SetLastError
api-ms-win-core-processthreads-l1-1-0
TlsSetValue
api-ms-win-core-winrt-l1-1-0
RoInitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
api-ms-win-core-heap-l1-1-0
HeapFree
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-security-base-l1-1-0
EqualSid
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-com-l1-1-0
CoGetMalloc
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
DebugBreak
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
ntdll
RtlDeriveCapabilitySidsFromName
api-ms-win-appmodel-runtime-internal-l1-1-1
GetPackageStatusForUser
api-ms-win-rtcore-ntuser-window-l1-1-0
GetMessageW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Sections
.MPRESS1 Size: 42KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE