Static task
static1
Behavioral task
behavioral1
Sample
ee9f0a538c49ce6d76bc15756c242457_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
ee9f0a538c49ce6d76bc15756c242457_JaffaCakes118
-
Size
216KB
-
MD5
ee9f0a538c49ce6d76bc15756c242457
-
SHA1
6f20ddd578484fc725851133a67013cb3cd81885
-
SHA256
9bf9014e9db112c79ac5c0cbafcd5d8b11db360904f981f420ff8ca367a816ff
-
SHA512
e5141ba12368e24d0500bed97e2e91586d200a83a1245f3ed41a9499323b5f36260eed9365535de45116f56c7414f18acdc89208ad508e2e0af7c8cd8a8a5c23
-
SSDEEP
3072:KmDPPJPznQjexBGT8o8MYEmuHYdhH0TSiBfpJ1mMkkj6:K8PRPjQq68MYEmuHY7H0TSiXCk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ee9f0a538c49ce6d76bc15756c242457_JaffaCakes118
Files
-
ee9f0a538c49ce6d76bc15756c242457_JaffaCakes118.exe windows:4 windows x86 arch:x86
4354707960c3f1d6acdc5fd819d2d2cc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_SYSTEM
PDB Paths
Imports
kernel32
GetSystemDefaultLCID
CreateMemoryResourceNotification
FlsFree
GetOEMCP
Heap32ListFirst
FlsGetValue
GetBinaryTypeW
SwitchToThread
SetSystemTimeAdjustment
ReadConsoleA
advapi32
GetKernelObjectSecurity
RegConnectRegistryA
ole32
MonikerRelativePathTo
oleaut32
VarBoolFromI8
DispCallFunc
gdi32
FrameRgn
netapi32
NetUserGetGroups
user32
mouse_event
SetWindowPos
RealChildWindowFromPoint
DestroyMenu
GetParent
IsProcessDPIAware
TranslateAcceleratorA
GetMenuState
IsHungAppWindow
ReuseDDElParam
msi
ord30
Sections
.rdata Size: 188KB - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.text Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.CRT Size: 4KB - Virtual size: 1KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ