Static task
static1
Behavioral task
behavioral1
Sample
d249478e73d67394458120073f35e99b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d249478e73d67394458120073f35e99b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d249478e73d67394458120073f35e99b_JaffaCakes118
-
Size
76KB
-
MD5
d249478e73d67394458120073f35e99b
-
SHA1
bc22dbf1e4e576ba6e210271a0852c48121d8b56
-
SHA256
536e57b84012956d85cfd6d499abe0ea7e8d8b38f4ee30f4a0c4d9b172550c0d
-
SHA512
6b0d39a3131168048e525745a7b81cce4dc577627d6f9d157f6b539ae8157bfd8ab968a3221d173b51c933101bda4bd58aec9d8dc02457c80e5136b4520e743b
-
SSDEEP
768:S3ATxXybQ2//fmFx/WR4yqJJlY5E8MFT3vuI4nn0pTgSGskP8tccPILEVtWT3t0l:vTU9/XWtVjYab4nnskeP73mt0TIo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d249478e73d67394458120073f35e99b_JaffaCakes118
Files
-
d249478e73d67394458120073f35e99b_JaffaCakes118.exe windows:4 windows x86 arch:x86
c25f8df69be86f7107116f15c0dde174
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ConnectNamedPipe
WriteFile
WideCharToMultiByte
ReadFile
CreateNamedPipeA
CloseHandle
LocalFree
InterlockedDecrement
FreeLibrary
InitializeCriticalSection
LeaveCriticalSection
GetProcAddress
EnterCriticalSection
LoadLibraryA
DeleteCriticalSection
VirtualFree
VirtualAlloc
GetModuleHandleA
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
RaiseException
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
HeapDestroy
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
HeapSize
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
RtlUnwind
MultiByteToWideChar
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Sections
.text Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ