Static task
static1
Behavioral task
behavioral1
Sample
f5661c47c62e74fdd1c5e51f7a37b9d7_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f5661c47c62e74fdd1c5e51f7a37b9d7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f5661c47c62e74fdd1c5e51f7a37b9d7_JaffaCakes118
-
Size
588KB
-
MD5
f5661c47c62e74fdd1c5e51f7a37b9d7
-
SHA1
26425204eb0036d43ec893280d7ff72cd0492998
-
SHA256
54b108696ea2babb0ec1e1e4d0f9dc394c522eac8c735e47e6bf22760324bc8e
-
SHA512
b2df402e4beee4d756f53d6c73b2a0d7000fd4872e813b572f17684d8442aa076f4ad0bb80c98d04b7a3299f70b947bc12a577a0951642bec63d9a72623d8a9d
-
SSDEEP
12288:SUQec9TwFoJpaz/g/J/v+BW/wBxd6M0lS+gmzdRt+BiPpR:1O9Twqaz/g/J/OBxP0lSczsM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f5661c47c62e74fdd1c5e51f7a37b9d7_JaffaCakes118
Files
-
f5661c47c62e74fdd1c5e51f7a37b9d7_JaffaCakes118.exe windows:4 windows x86 arch:x86
446d52823620d2e102fe9a93522e24d3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
ExitWindowsEx
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
kernel32
lstrcatA
lstrcmpiA
GlobalAlloc
CloseHandle
CreateFileA
CreateToolhelp32Snapshot
ExitProcess
FindResourceA
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetWindowsDirectoryA
GlobalFree
LoadLibraryA
LoadResource
LockResource
MoveFileExA
MultiByteToWideChar
OpenProcess
Process32First
Process32Next
RtlMoveMemory
RtlZeroMemory
SizeofResource
TerminateProcess
WriteFile
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 932B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 583KB - Virtual size: 583KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ