Static task
static1
Behavioral task
behavioral1
Sample
d41fc4cbfff49a6d6a51c381a15b42cd_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d41fc4cbfff49a6d6a51c381a15b42cd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d41fc4cbfff49a6d6a51c381a15b42cd_JaffaCakes118
-
Size
477KB
-
MD5
d41fc4cbfff49a6d6a51c381a15b42cd
-
SHA1
494a128a76f8f0ef0f37741cc2ae76180b209b59
-
SHA256
31e281edc87adcaf9ae3bfb6d435dfe95653878302df0ef25afbe39350846548
-
SHA512
1afd48921f7c4199757e751b8ff82b650cb74073bc3d8cef4368d57c199e504e06c0b0635fc926ccaa23602a26f66a112aa29c508ac8fb9dde2193cc62e39520
-
SSDEEP
6144:S9YBClEpBxT+MMn2daCowfs9SgfTJwdh3ysF+2GkN27/DKYxlFsQftz2J4nVKKZo:DNVSnjCFfEyBkDykKYxTtA4n0so
Malware Config
Signatures
-
Molebox Virtualization software 1 IoCs
Detects file using Molebox Virtualization software.
resource yara_rule sample molebox -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d41fc4cbfff49a6d6a51c381a15b42cd_JaffaCakes118
Files
-
d41fc4cbfff49a6d6a51c381a15b42cd_JaffaCakes118.exe windows:4 windows x86 arch:x86
5549afdec7106febd0f708bda733b0de
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCloseKey
RegOpenKeyExW
RegSetValueA
kernel32
CreateFileA
ExitProcess
MapViewOfFile
SetUnhandledExceptionFilter
TerminateProcess
msvcrt
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
memcpy
signal
strcpy
wcscpy
user32
CheckMenuRadioItem
ClientToScreen
CreateAcceleratorTableW
DestroyMenu
DrawIconEx
DrawMenuBar
DrawStateW
EnumClipboardFormats
GetCursorPos
GetDlgItem
GetForegroundWindow
GetMessagePos
GetMessageW
GetSystemMetrics
GetWindowRect
GetWindowTextW
IsIconic
LoadIconW
MsgWaitForMultipleObjects
PeekMessageW
PostQuitMessage
SetClipboardData
SetWindowTextW
UnionRect
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 333KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 2KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ