Static task
static1
Behavioral task
behavioral1
Sample
c04c796ef126ad7429be7d55720fe392_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c04c796ef126ad7429be7d55720fe392_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c04c796ef126ad7429be7d55720fe392_JaffaCakes118
-
Size
297KB
-
MD5
c04c796ef126ad7429be7d55720fe392
-
SHA1
736b3840258423709a60321bcaf083083ebf598f
-
SHA256
4b5d1a0a25b932ed9410f60751359f527b55619d036f727d6e1caacaba23640b
-
SHA512
c399203bc0b3eddee9c71a651502eab68321ecd3cec172864d41b642cbdf1ea73586179d1afa0bb0e69ad57c24d7f401f7a5ba404ebfb7a333a94c6727d591b4
-
SSDEEP
6144:DfiamRIUe5JVxpPa2Js3VgtspgPpnYB78eGFfWND1CJQHSByT8Tn:D6aoq5JVxpPa2JCVglCB78r4RxHzT8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c04c796ef126ad7429be7d55720fe392_JaffaCakes118
Files
-
c04c796ef126ad7429be7d55720fe392_JaffaCakes118.exe windows:4 windows x86 arch:x86
45909c21ccb55f8756dc92f10b7bd5fd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
GetTickCount
CreateDirectoryA
ExpandEnvironmentStringsA
WaitForSingleObject
GetStartupInfoA
SetCurrentDirectoryA
CreateProcessA
FreeResource
CreateFileA
SizeofResource
LoadResource
FindResourceA
GetModuleHandleA
IsDebuggerPresent
ExitProcess
GetModuleFileNameA
WinExec
DeleteFileA
Sleep
CloseHandle
WriteFile
GetLastError
advapi32
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDestroyHash
CryptDecrypt
CryptEncrypt
shell32
ShellExecuteA
lz32
LZOpenFileA
LZClose
LZCopy
msvcrt
printf
free
fclose
fwrite
fread
malloc
fopen
memcpy
strlen
_beginthreadex
strcpy
strstr
memset
ftell
fseek
strcat
sprintf
strncmp
memmove
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 278KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ