Static task
static1
Behavioral task
behavioral1
Sample
de81960dbeee175e5659da1f4656cf34_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de81960dbeee175e5659da1f4656cf34_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
de81960dbeee175e5659da1f4656cf34_JaffaCakes118
-
Size
253KB
-
MD5
de81960dbeee175e5659da1f4656cf34
-
SHA1
d9ee4db5c30c019fd55757cd8abaf1fe558b970a
-
SHA256
de7f7d4248b848024629ea380a152ddd681ca814a3849266940123a987cedd0d
-
SHA512
4b8adc710ed23e7124bdbf045a769da2de2f5a4d978700d36e9be524bfbe8eb7ba55432e68a7c4acc65bccbe768975e253b8cfed74ca22a900a76efa4942f793
-
SSDEEP
6144:IoMazGcbeLHWkd/1t8MUZ0qQgIX800Z6H3UMAj:NxzXeLHW8/1t8F0q+8vMW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de81960dbeee175e5659da1f4656cf34_JaffaCakes118
Files
-
de81960dbeee175e5659da1f4656cf34_JaffaCakes118.exe windows:4 windows x86 arch:x86
f87708d68dbfafb9e7f6cd7a710430dc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocalTime
MultiByteToWideChar
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
Sleep
lstrcmpA
GetProcAddress
LoadLibraryA
advapi32
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyW
query
CIState
LoadIFilter
DllUnregisterServer
CiSvcMain
LocateCatalogsW
BeginCacheTransaction
CITextToFullTree
mscat32
CryptCATEnumerateAttr
DllRegisterServer
CryptCATPutAttrInfo
CryptCATStoreFromHandle
CryptCATOpen
CryptCATVerifyMember
Sections
.icode Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 3KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 88KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 125KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ