Static task
static1
Behavioral task
behavioral1
Sample
c1710a111feee5acb443870752c1607a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c1710a111feee5acb443870752c1607a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c1710a111feee5acb443870752c1607a_JaffaCakes118
-
Size
544KB
-
MD5
c1710a111feee5acb443870752c1607a
-
SHA1
f180851070a87cc648fcdd327af749c43c149145
-
SHA256
2c3027a03a464a868ad9644752803306c2a3277a31714800c42d6992c03c4e9d
-
SHA512
8451d1446702c715b689b0c40ac3a47b7b69972fec74cad0d076bc009c7ba629b5c109e3010560cb5c95773c2f60e40484ee231ae83a6ecb6405458cc411c441
-
SSDEEP
6144:nr19x/To2p5s9pV7bERk0oEl7ktxr4EdNNy0TRr0fbdIBn0iaIt01OP7+ri39zsl:r1y9L710oE5kXrRdNNyE2dIB0ij6Qcd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1710a111feee5acb443870752c1607a_JaffaCakes118
Files
-
c1710a111feee5acb443870752c1607a_JaffaCakes118.exe windows:4 windows x86 arch:x86
4d0718ecfdbf54c99237b2c095ea36e5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
WideCharToMultiByte
GetCommandLineW
GetModuleFileNameA
TerminateProcess
WaitForSingleObject
ResumeThread
SetThreadContext
WriteProcessMemory
GetProcAddress
GetModuleHandleA
VirtualProtectEx
VirtualAllocEx
VirtualAlloc
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
GetLastError
ReadFile
GetCurrentProcess
SetFilePointer
HeapAlloc
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
HeapReAlloc
SetStdHandle
FlushFileBuffers
CloseHandle
CreateFileA
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
SetEndOfFile
GetStringTypeW
user32
MessageBoxA
shell32
CommandLineToArgvW
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Smiley Size: 4KB - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 892B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
. Size: 244KB - Virtual size: 242KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. Size: 244KB - Virtual size: 242KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE