Static task
static1
Behavioral task
behavioral1
Sample
eeb5ba2de9e796310864049fa795af66_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
eeb5ba2de9e796310864049fa795af66_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eeb5ba2de9e796310864049fa795af66_JaffaCakes118
-
Size
429KB
-
MD5
eeb5ba2de9e796310864049fa795af66
-
SHA1
56be0afa8e92695b025cca3f8db773f996200366
-
SHA256
b9f9157337853286dc2d2d20da1acf22aee013e8c580d6a72b18238dd8fc63c7
-
SHA512
7f63016cd62a6e11ce0bb4a627feb4962ed43f5088a5cc4fdbb109f89685700414a34e5d29ad10bc1cef5c74b6b8946e4ca26f3ae6ac3ce37521f1ce68a043dc
-
SSDEEP
3072:L6daNayplcRPGKzlw9RfVFH0v6JqxBlkIT:mdwayHcROKRWf3UyIxXpT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eeb5ba2de9e796310864049fa795af66_JaffaCakes118
Files
-
eeb5ba2de9e796310864049fa795af66_JaffaCakes118.exe windows:4 windows x86 arch:x86
168aecddd46e49bab5e36f7feba40f71
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
FindNextFileA
FindFirstFileA
ReadProcessMemory
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
user32
RegisterClassExA
LoadCursorA
LoadStringA
UpdateWindow
ShowWindow
CreateWindowExA
PostQuitMessage
EndPaint
DrawTextA
GetClientRect
BeginPaint
DialogBoxParamA
DestroyWindow
DefWindowProcA
EndDialog
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadIconA
msvcrt
strlen
strcat
strcpy
memcpy
strrchr
Sections
.text Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 220KB - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE