Static task
static1
Behavioral task
behavioral1
Sample
bf496a67e14d1dc3b9289c69c9f9cc3b_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
bf496a67e14d1dc3b9289c69c9f9cc3b_JaffaCakes118
-
Size
72KB
-
MD5
bf496a67e14d1dc3b9289c69c9f9cc3b
-
SHA1
8a5446a1e6fd8dd758343c14ae07d7740bb4cf30
-
SHA256
5f4294ab7ff888689251056f6272ad92f0cf22dfe2897d030a21e02e790094ae
-
SHA512
5ca0a5afad7a39c9b699aacf6f757f813f3cc2547a9c1da81d404f1f1a655cee0b09976e80f9a2cc561c41eaf5dce09d0450e5eb3b546f209520a26ba3daa457
-
SSDEEP
1536:c7NvDg3TL1BY3LlOg62dWWw3RgdjgAOqhLsA47D:c7Nv2BY3Ll34Ww36dsV9D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf496a67e14d1dc3b9289c69c9f9cc3b_JaffaCakes118
Files
-
bf496a67e14d1dc3b9289c69c9f9cc3b_JaffaCakes118.exe windows:4 windows x86 arch:x86
67f97966665a26bcf33b75ee31383383
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
VirtualProtect
ExitProcess
HeapAlloc
GetProcessHeap
UnmapViewOfFile
GetProcAddress
LoadLibraryA
IsBadReadPtr
HeapFree
FreeLibrary
VirtualAlloc
FindResourceA
SizeofResource
LoadResource
VirtualFree
LockResource
HeapReAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
HeapSize
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
RtlUnwind
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
WriteFile
GetCPInfo
GetACP
GetOEMCP
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
MessageBoxA
advapi32
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDecrypt
Sections
.text Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ