Static task
static1
Behavioral task
behavioral1
Sample
ead92e23ee7b58405fe4872b6a5c4497_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ead92e23ee7b58405fe4872b6a5c4497_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ead92e23ee7b58405fe4872b6a5c4497_JaffaCakes118
-
Size
124KB
-
MD5
ead92e23ee7b58405fe4872b6a5c4497
-
SHA1
fbb4d303f11fb4334fb4fbf4afcda7a4e838d9b8
-
SHA256
51781a5d03853b1bc8d7b21cb25467958a15482983698ed9cb5abdd68227e438
-
SHA512
37c4517010d7f7e069a61ad65b7c6d18296bcacbc0e3536a258c54da66624d102b1641cbbca2f7060b23268261fe291e5dd511a6a060e268a86e323988ad3fa9
-
SSDEEP
3072:Bm6TL+i0nRFa8sbs8t6e6cBlRCkRiXNgXAO+KF:D+iYFaPs8tjZB2kodgwJK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ead92e23ee7b58405fe4872b6a5c4497_JaffaCakes118
Files
-
ead92e23ee7b58405fe4872b6a5c4497_JaffaCakes118.exe windows:3 windows x86 arch:x86
b3c0857fc803d4274091033b9e6f05a7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
EnterCriticalSection
GetCurrentProcessId
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
HeapFree
InitializeCriticalSection
LoadLibraryA
SetLastError
VirtualAlloc
lstrlenA
user32
DialogBoxParamA
EnableWindow
GetFocus
GetParent
GetSysColor
IsDlgButtonChecked
IsWindow
LoadIconA
SendMessageA
SetCursor
SetWindowLongA
SetWindowTextA
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 89KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ