Static task
static1
Behavioral task
behavioral1
Sample
ce84f1c7862cac1b9119669866c63778_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ce84f1c7862cac1b9119669866c63778_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ce84f1c7862cac1b9119669866c63778_JaffaCakes118
-
Size
141KB
-
MD5
ce84f1c7862cac1b9119669866c63778
-
SHA1
6af448e55d39e27546972cff23ed884a42fdb6f1
-
SHA256
12900338dd57e1e60cb8a1286d9fc0651b25fc68a41a999867367315bc79c354
-
SHA512
0daa7e37a5d9aa3a5b7f0108f0f2ed5bc4b40dcb554f7a1cc8204d8364ad1b8ca3fb9178c0410a4a137d293a6e361827abf2424c35a9057937a66e0d4d94c85a
-
SSDEEP
3072:kqNbcrKZjn46Grvre81wh2hQ5AQd14uibpNb+ym0NeY2Kb:kqNbAKZj46GrDbM5bd14uYqym0Ne0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce84f1c7862cac1b9119669866c63778_JaffaCakes118
Files
-
ce84f1c7862cac1b9119669866c63778_JaffaCakes118.exe windows:4 windows x86 arch:x86
5b933ddda3d867fee2df6cef4a82c679
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WriteProcessMemory
VirtualAllocEx
Sleep
SetThreadContext
ResumeThread
ReadProcessMemory
GetThreadContext
GetTempPathA
ExitProcess
CreateProcessA
CloseHandle
GetCurrentThreadId
GetLastError
ExitProcess
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetSystemTime
GetFileType
CreateFileA
CloseHandle
GetCommandLineA
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
shell32
ShellExecuteA
user32
CharNextA
SendMessageA
PostMessageA
MoveWindow
FindWindowExA
FindWindowA
Sections
CODE Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
XEK Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 568B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
upx Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ