Static task
static1
Behavioral task
behavioral1
Sample
eb7a1ad1366efc54ca4cc66ed71cbdab_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eb7a1ad1366efc54ca4cc66ed71cbdab_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eb7a1ad1366efc54ca4cc66ed71cbdab_JaffaCakes118
-
Size
24KB
-
MD5
eb7a1ad1366efc54ca4cc66ed71cbdab
-
SHA1
601579c5c7fb281f59faf50972eef93b9acadd2f
-
SHA256
716228b54e950567edb52fe53b28e03cd6670e3a048013ec3b3b05b56c780899
-
SHA512
0d20f96d4215aa28dc0eaae363d62f19bc8c7c4416e30813b832969593523958fd67488a6280c179384cc4bd822417100f4e97911531eb59ea2ab6dca7e068a9
-
SSDEEP
384:AZyFZBf6K79DxWskMtGNYYlgpklLrZ4lhMK:xFZB11DtmWpefYZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb7a1ad1366efc54ca4cc66ed71cbdab_JaffaCakes118
Files
-
eb7a1ad1366efc54ca4cc66ed71cbdab_JaffaCakes118.exe windows:4 windows x86 arch:x86
17a9f35df002fc9fd4f7f670c8b88bce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetThreadPriority
CreateThread
OpenProcess
OpenEventA
GetCurrentThread
GetStartupInfoA
ExitProcess
GetCommandLineA
GetModuleHandleA
HeapAlloc
GetProcessHeap
HeapFree
lstrlenA
lstrcatA
lstrcpyA
GetVersionExA
WaitForMultipleObjects
GetLastError
CreateDirectoryA
SetLastError
GetSystemDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryA
OpenFile
OpenMutexA
MapViewOfFile
OpenFileMappingA
ResetEvent
ReleaseMutex
lstrcpynA
CreateEventA
UnmapViewOfFile
lstrcmpiA
WritePrivateProfileStringA
lstrcmpA
SetEvent
WriteFile
MultiByteToWideChar
CreateFileA
CloseHandle
WaitForSingleObject
DeleteFileA
user32
GetKeyboardType
DispatchMessageA
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects
DdeNameService
DdeQueryStringA
DdeCmpStringHandles
EnumWindows
CharNextA
GetClassNameA
DdeAccessData
DdeUnaccessData
DdeFreeDataHandle
DdeFreeStringHandle
DdeCreateStringHandleA
DdeUninitialize
DdeInitializeA
wsprintfA
DdeConnect
DdeClientTransaction
PostMessageA
DdeDisconnect
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA
RegQueryValueExA
ole32
CoCreateInstance
CoInitialize
CoUninitialize
CLSIDFromProgID
oleaut32
VariantClear
VariantInit
SysAllocStringLen
SysFreeString
Sections
.text Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE