Static task
static1
Behavioral task
behavioral1
Sample
d408a8c760753db318b2e7a816879d26_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d408a8c760753db318b2e7a816879d26_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d408a8c760753db318b2e7a816879d26_JaffaCakes118
-
Size
40KB
-
MD5
d408a8c760753db318b2e7a816879d26
-
SHA1
c6d3c1909f8b76afc35ebf9742a4a335ca3dccb8
-
SHA256
8d53a31436a800f2f48ee93546eccf574cce8c4621a8c3888f7c97c7c2c08b1a
-
SHA512
4767c96af5e8a40985aa833b2ba9945e70f390b77ad94486faf8747e1d0d5c7ec4a17cd7bdfa29964ec9a178c5c1375131d80b2690788227b89398afbdae6996
-
SSDEEP
384:EG3vxwEHhW0jwZGxVou9x+EDBn7NBkLEwoQcOD3FQDZuzk0yiNW/SClu+zrH/1Er:EGZBbiAV/Dftwo63gEzkVSWBXfyMQcY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d408a8c760753db318b2e7a816879d26_JaffaCakes118
Files
-
d408a8c760753db318b2e7a816879d26_JaffaCakes118.exe windows:4 windows x86 arch:x86
c38e918e31cb1ffd24ba7f57d94f48db
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
DestroyWindow
GetClientRect
LoadCursorW
MoveWindow
SetActiveWindow
shell32
DuplicateIcon
ExtractIconEx
SHGetFileInfo
SHGetSpecialFolderLocation
kernel32
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE