Static task
static1
Behavioral task
behavioral1
Sample
e06a84d1c4e825948e56cf84bd7039ed_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e06a84d1c4e825948e56cf84bd7039ed_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e06a84d1c4e825948e56cf84bd7039ed_JaffaCakes118
-
Size
5KB
-
MD5
e06a84d1c4e825948e56cf84bd7039ed
-
SHA1
7d654f77db464098e9a697d6fde042ad892eb3fb
-
SHA256
42c34d82da940c700ab0befa8a429f4bd90e694136e43268d52dbef58f0cec7c
-
SHA512
11c90f75a34c003eb5b12a3c075971b2e01706cbd30368f2b3159b13e2b2aaafdad48657e9ffb0a6bfaa770be2484232da04739e0c98c1019a6757d9ac12ac13
-
SSDEEP
96:duenc3IIc+l60prjSuRXzYxIccesozEHUoynHFLaDLyYWE:dueYIIc+ljSKZe5wHUoynlLaDLCE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e06a84d1c4e825948e56cf84bd7039ed_JaffaCakes118
Files
-
e06a84d1c4e825948e56cf84bd7039ed_JaffaCakes118.exe windows:4 windows x86 arch:x86
bc8160debed1417f3bed478e9660c9a5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA
AdjustTokenPrivileges
msvcrt
exit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
tolower
strstr
time
kernel32
CreateRemoteThread
OpenProcess
VirtualAllocEx
GetStartupInfoA
DeleteFileA
CopyFileA
CreateProcessA
GetCurrentProcessId
LoadLibraryA
Sleep
CreateToolhelp32Snapshot
Process32First
Process32Next
lstrcmpiA
GetVersionExA
GetModuleFileNameA
BeginUpdateResourceA
FindResourceA
CloseHandle
GetCurrentProcess
VirtualFreeEx
WaitForSingleObject
GetSystemDirectoryA
WriteProcessMemory
GetProcAddress
GetModuleHandleA
LockResource
LoadResource
lstrcatA
GetLastError
CreateMutexA
EndUpdateResourceA
WriteFile
CreateFileA
SizeofResource
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ