Static task
static1
Behavioral task
behavioral1
Sample
e119b6242f793a4d536159060d8009f1_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e119b6242f793a4d536159060d8009f1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e119b6242f793a4d536159060d8009f1_JaffaCakes118
-
Size
328KB
-
MD5
e119b6242f793a4d536159060d8009f1
-
SHA1
49cc5f9cfea5c01f77aa7d33192a28aa5089d464
-
SHA256
2d160f802f2835b98ce31906dd6803476f014661c472f6478bd56bf811c7031a
-
SHA512
213e08c6cbc5b474be91b4682e00156c26a259e3e262591165b8dd4d0b2a4df0f580ea6d8820e22594b978824e5f377688fa3a7ea923a90ad0f6517b86f14342
-
SSDEEP
6144:lAOlfFYViOkjJEZE4fC/Q9D03bcPSl5xhUDV9kl+JKODK1QztG/7:lnf+ViDEyBQ6r/gDo8JKO4v7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource e119b6242f793a4d536159060d8009f1_JaffaCakes118
Files
-
e119b6242f793a4d536159060d8009f1_JaffaCakes118.exe windows:4 windows x86 arch:x86
2496ed614d5ae97f49a04d5cdd608bc9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
fscanf
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
acos
_mbsnbcnt
fread
_onexit
__dllonexit
_safe_fdivr
advapi32
SetNamedSecurityInfoA
GetFileSecurityA
GetTrusteeTypeA
CreateServiceA
SetServiceStatus
user32
CreateIconFromResourceEx
CreateIconFromResource
IsMenu
ShowCaret
EmptyClipboard
DefFrameProcW
PostQuitMessage
ShowCursor
CharUpperA
PostMessageW
GetSystemMetrics
LoadMenuW
IsCharLowerA
IsClipboardFormatAvailable
SetMenu
EnableWindow
GetKeyboardLayoutNameW
SetWindowLongW
LockWindowUpdate
ValidateRect
CopyImage
GetMenuState
GetGUIThreadInfo
DrawFrameControl
CheckRadioButton
oleaut32
LPSAFEARRAY_UserMarshal
mpr
WNetAddConnectionA
mfc42
ord5731
ord1098
ord3922
ord4486
ord6375
ord815
ord1089
ord1085
ord2396
ord1030
ord1029
ord5302
ord2725
ord1083
ord1576
ord1168
ord561
ord3738
ord4424
ord1090
ord4080
ord3079
ord3825
ord3831
ord3830
ord1004
ord2976
ord3081
ord2985
ord3262
ord1074
ord4465
ord3259
ord1029
ord2982
ord1046
ord5714
ord1064
ord5307
ord1077
ord1061
Sections
.text Size: 168KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ