Static task
static1
Behavioral task
behavioral1
Sample
eac9195c4ac0bc7fceacaa3dd9ab3217_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eac9195c4ac0bc7fceacaa3dd9ab3217_JaffaCakes118
-
Size
22KB
-
MD5
eac9195c4ac0bc7fceacaa3dd9ab3217
-
SHA1
764740b92722004ef355b7e9445bbf5af370c68c
-
SHA256
33719ea1a87ec696d973fb631da4d0016c2e891b54471962c3c2ef4852f5d090
-
SHA512
1c7862a6b8d28b2ffb86ca29cb0ad7ecc5bf9afa9a2ba0ae2d42258a1e0fc884b96c37009af85f3e54309baee9545b3e681da440f9e307a0a3adbae1563f3bc2
-
SSDEEP
384:2EBWLhpXxxn6gnuaOYRy+DUTf0Z43wq2DASD+7vvxlLQWtzW4:DBGhpz6gnS9063wNDASD+7DDF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eac9195c4ac0bc7fceacaa3dd9ab3217_JaffaCakes118
Files
-
eac9195c4ac0bc7fceacaa3dd9ab3217_JaffaCakes118.exe windows:10 windows x86 arch:x86
c7066794c87fff320055e267ec56d72e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-core-windowserrorreporting-l1-1-0
WerSetFlags
api-ms-win-eventlog-legacy-l1-1-0
ReportEventW
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
api-ms-win-core-processthreads-l1-1-0
ExitProcess
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetErrorMode
api-ms-win-core-synch-l1-1-0
SetEvent
api-ms-win-security-base-l1-1-0
CheckTokenMembership
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-1-0
HeapFree
api-ms-win-core-registry-l1-1-0
RegCloseKey
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-sysinfo-l1-2-0
GetNativeSystemInfo
api-ms-win-composition-redirection-l1-1-0
DwmInitializePort
api-ms-win-composition-windowmanager-l1-1-0
ord101
api-ms-win-dx-d3dkmt-l1-1-0
D3DKMTSetProcessSchedulingPriorityClass
api-ms-win-rtcore-ntuser-private-l1-1-0
RegisterSessionPort
api-ms-win-rtcore-ntuser-private-l1-1-2
DwmKernelStartup
api-ms-win-rtcore-ntuser-window-l1-1-0
GetMessageW
ntdll
DbgPrompt
dxgi
DXGIDeclareAdapterRemovalSupport
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureStackBackTrace
api-ms-win-core-errorhandling-l1-1-3
TerminateProcessOnMemoryExhaustion
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
Sections
.MPRESS1 Size: 13KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE