Static task
static1
Behavioral task
behavioral1
Sample
e0569c1348e8221c726cf76bccc52225_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e0569c1348e8221c726cf76bccc52225_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e0569c1348e8221c726cf76bccc52225_JaffaCakes118
-
Size
361KB
-
MD5
e0569c1348e8221c726cf76bccc52225
-
SHA1
3ce114a3d4245ed71c5e22ab0ed4a06e8a33a34a
-
SHA256
053b50e761bccb36791b38386664cd4b6f98d4b6eafa20a17725fe8fcbcb4538
-
SHA512
07eb6d1790427e3c18e45a57968009be48c1818ed16f5167c0fad33f13d1eadbbc6e7539730e577cc38db14574f661734d30a75087952bcac44b3b2353c5df9d
-
SSDEEP
6144:Bw7Vd0b2Aie+o3RQ+EoHWuO8dCSXnqxbUPobVl7tQDkiahNbjWXxZnBWgx:Bw7rvC5N2uA9rhN3W7Qgx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e0569c1348e8221c726cf76bccc52225_JaffaCakes118
Files
-
e0569c1348e8221c726cf76bccc52225_JaffaCakes118.exe windows:4 windows x86 arch:x86
0899120ade73aa8569df085e98ca4eb9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateFileMappingW
CreateFileW
ExitProcess
GetCommandLineW
GetConsoleOutputCP
GetFileSize
GetFullPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
GetStdHandle
GetTickCount
GetUserDefaultLCID
HeapAlloc
HeapFree
HeapReAlloc
IsBadStringPtrA
IsBadStringPtrW
MapViewOfFile
MultiByteToWideChar
UnmapViewOfFile
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrcmpW
advapi32
RegCloseKey
RegOpenKeyW
RegQueryValueW
ole32
CLSIDFromProgID
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
LoadTypeLib
SafeArrayAccessData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnaccessData
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
VariantChangeType
shell32
CommandLineToArgvW
ucrtbase
__acrt_iob_func
__p___argc
__p___wargv
__stdio_common_vsprintf
_configure_wide_argv
_get_initial_wide_environment
_initialize_wide_environment
_set_app_type
_strdup
_wcsicmp
exit
free
fwrite
getenv
memcmp
memcpy
memmove
strchr
strcmp
strcpy
strcspn
strlen
wcsrchr
user32
MessageBoxW
Sections
.text Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 768B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
/4 Size: 4KB - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/19 Size: 144KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/31 Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/45 Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/57 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/70 Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/81 Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ