C:\Hello\Insert\Data\File.exe
Static task
static1
Behavioral task
behavioral1
Sample
eb9ace42ad371f175b3d5a2dc2a3ebd8_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eb9ace42ad371f175b3d5a2dc2a3ebd8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eb9ace42ad371f175b3d5a2dc2a3ebd8_JaffaCakes118
-
Size
212KB
-
MD5
eb9ace42ad371f175b3d5a2dc2a3ebd8
-
SHA1
2b564f4ec59e233b9400647dfd483c2c437168aa
-
SHA256
93bb492a6055d8360946d3b18003c1e45903d0685a8a7eb639ba174d203c6c40
-
SHA512
c70233eda1f618d16596f722bc5a0b43f0abd003a69489cd2cd90fd520950230c35de8df6bb24bf80e994e10ea31168e12a5bb7305cede967d0549928271c916
-
SSDEEP
3072:LQqcLLv7omjwhQvMYycYc2aJqNqUzDGfU6Mm6B7ZumFeD5ToNeAzHPhu1FtBGkFX:0PfjwhQnXYc2aCz6fUvnRoD5TdADsTz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb9ace42ad371f175b3d5a2dc2a3ebd8_JaffaCakes118
Files
-
eb9ace42ad371f175b3d5a2dc2a3ebd8_JaffaCakes118.exe windows:5 windows x86 arch:x86
33b5e23d6ad80093c31498faf7454b7f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetWindowsDirectoryW
MoveFileA
lstrlenA
LCMapStringW
FindNextFileW
OpenFile
MultiByteToWideChar
CreateFileMappingA
FindResourceA
WriteFile
LocalLock
IsValidLanguageGroup
FileTimeToSystemTime
EnumResourceLanguagesA
UnmapViewOfFile
WaitForMultipleObjects
LockFile
IsValidLocale
FlushViewOfFile
GetHandleInformation
GetCommProperties
FileTimeToDosDateTime
GetShortPathNameW
SetSystemTime
_lwrite
HeapUnlock
FindResourceW
CreateMailslotW
FormatMessageW
SetCommBreak
GetCommandLineA
GetVersionExA
SetHandleCount
VirtualProtect
GetCommModemStatus
CreateNamedPipeA
GetDateFormatW
GetFullPathNameA
ClearCommError
ReadFile
EnumResourceNamesA
FindNextChangeNotification
SizeofResource
CreatePipe
CompareStringA
psapi
QueryWorkingSet
shlwapi
PathUnmakeSystemFolderA
advapi32
RegQueryValueExA
RegQueryValueExW
RegReplaceKeyA
user32
IsCharAlphaNumericA
Exports
Exports
_IsWow64MessageIsWow64Message@0
Sections
.text Size: 204KB - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 990B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ