Static task
static1
Behavioral task
behavioral1
Sample
e2308190ca0406f8ccf3d26efa535b9d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e2308190ca0406f8ccf3d26efa535b9d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e2308190ca0406f8ccf3d26efa535b9d_JaffaCakes118
-
Size
68KB
-
MD5
e2308190ca0406f8ccf3d26efa535b9d
-
SHA1
c83d810708f8dffffef6e608baf33ca61fa8ed87
-
SHA256
4603c0e96cab507fb2273eb25c3280cd4e2a10da93914814d95db4d8e2b50909
-
SHA512
4e6736bc96761a6ad8b4e496cc8d98a6e0eacf2ac48a13b81274d8d315a700b00c4361a461cd134ad1acccd65cbdac833c7306ccf321e33f72692b032d186c1a
-
SSDEEP
768:x70rGhlDPSfqH47b5jeyit7M0N6llV63nFJLWM+B4HHu2L3kInoQXqlIR3DEDqq/:KaF4H9eylls3nTLSsDzntq+oqxk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2308190ca0406f8ccf3d26efa535b9d_JaffaCakes118
Files
-
e2308190ca0406f8ccf3d26efa535b9d_JaffaCakes118.exe windows:4 windows x86 arch:x86
b70bc165df692282c8efdf3372c603da
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapAlloc
GetProcessHeap
VirtualAlloc
VirtualProtect
VirtualFree
GetProcAddress
LoadLibraryA
IsBadReadPtr
HeapFree
FreeLibrary
CloseHandle
SetFilePointer
WriteFile
GetTickCount
CreateFileA
CopyFileA
GetWindowsDirectoryA
GetModuleFileNameA
Sleep
DeleteFileA
WinExec
GetSystemDirectoryA
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GetStringTypeW
GetStringTypeA
RtlUnwind
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetLastError
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
FlushFileBuffers
shlwapi
PathFileExistsA
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE