Static task
static1
Behavioral task
behavioral1
Sample
d358acda4a09c43eac5964d8697bedc9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d358acda4a09c43eac5964d8697bedc9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d358acda4a09c43eac5964d8697bedc9_JaffaCakes118
-
Size
161KB
-
MD5
d358acda4a09c43eac5964d8697bedc9
-
SHA1
74c830b538e43fcb7fe6fe9b0bcf0b61a0e5fd44
-
SHA256
10d2f1629d0509d2af6380e0072e80ac5e7ba27599dab77f36735ad4074ad18e
-
SHA512
edaa833741b46136dd72b32018f1b8c02a8be0a0b2a72592c7e81610c3c301ce1d902bb4b1d04d538453050009f2d57c341d8009cf0d0738f7e1a421cc2829ba
-
SSDEEP
3072:NjqyS9BRqKY5nZzTg2Mwh+qKZm7t5lyFjRondC4vc6nQMgXrhdJoys+sSryiYdy/:NjqyS9B0KY5n1Tay+itrMjRen06cd9sG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d358acda4a09c43eac5964d8697bedc9_JaffaCakes118
Files
-
d358acda4a09c43eac5964d8697bedc9_JaffaCakes118.exe windows:4 windows x86 arch:x86
bcc55020c433a05330dc840f639b205b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
GetLastError
ExitProcess
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
lstrcmpiA
WinExec
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
LockResource
LoadResource
LoadLibraryA
GetTickCount
GetTempPathA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
FreeResource
FreeLibrary
FindResourceA
VirtualProtect
GetModuleFileNameA
ExitProcess
oleaut32
SysFreeString
SysReAllocStringLen
user32
GetActiveWindow
MessageBoxA
Sections
CODE Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 30KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 129KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ