Static task
static1
Behavioral task
behavioral1
Sample
df47c5ae61c5d19e9f77a21ab9701df4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
df47c5ae61c5d19e9f77a21ab9701df4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df47c5ae61c5d19e9f77a21ab9701df4_JaffaCakes118
-
Size
38KB
-
MD5
df47c5ae61c5d19e9f77a21ab9701df4
-
SHA1
7ba454844d1688228585090ea745d5df90fb479e
-
SHA256
173e2746dc82866718dc38ac386152715f307bd27ada80e0af76f9c729ce3469
-
SHA512
a7cc71a1c931f3550ee0039f6984eac49d481cd0cd9adb5e5f9f1509a93ce7478c1c4d66258f370bae5a7bdd846c4a76f35cf298a26760c6911e592c3d0dec89
-
SSDEEP
768:tZFgbEKeyFfxlAbGQfoqZ7JEJdW/h/4tZtCYwf61FObh2TF:tZFg4mxlAxfLqdg/4jI1f6Xc0x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df47c5ae61c5d19e9f77a21ab9701df4_JaffaCakes118
Files
-
df47c5ae61c5d19e9f77a21ab9701df4_JaffaCakes118.exe windows:4 windows x86 arch:x86
160e0226afd1831375efe18133efaf2e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
DeleteFileA
VirtualProtect
GetTempPathA
ExitProcess
GetModuleFileNameA
IsBadReadPtr
GetModuleHandleA
GetProcAddress
CreateProcessA
ReadProcessMemory
GetCurrentProcess
Sleep
LoadLibraryA
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
CreateThread
CreateDirectoryA
GetSystemDirectoryA
OpenFile
FindNextFileA
FindFirstFileA
DeviceIoControl
WinExec
CopyFileA
lstrcatA
lstrcpyA
OutputDebugStringA
GetVersionExA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetFileSize
WriteFile
CreateFileA
SetFilePointer
ReadFile
LocalAlloc
CloseHandle
LocalFree
VirtualFree
VirtualAlloc
user32
wsprintfA
advapi32
ControlService
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
DeleteService
CreateServiceA
shell32
ShellExecuteA
urlmon
IsValidURL
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ