Static task
static1
Behavioral task
behavioral1
Sample
f5f9e4e160585a27895c121294a1140e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f5f9e4e160585a27895c121294a1140e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f5f9e4e160585a27895c121294a1140e_JaffaCakes118
-
Size
43KB
-
MD5
f5f9e4e160585a27895c121294a1140e
-
SHA1
9b834e2d14ae02aaa4e05847866d83eb8a9c8753
-
SHA256
61166edf230ad3e1e04a9669cdc6c16476eb4604c213b835b7f80e13c322623d
-
SHA512
40a1ce8a702bf7bede47a8d317be73d75bf4b4ae139bf1f75b8799423f95f4eed7bb45c22b483caffc960f0019e6357a29a127d06e13b8e5c5764920c9b9b89e
-
SSDEEP
768:KAi8xwZziYxCFHupj1N1KR5AwMvBfbV/5J/jf6zdnD:Kl7Z2uCspxN1w5Aw+BN5JLSRnD
Malware Config
Signatures
Files
-
f5f9e4e160585a27895c121294a1140e_JaffaCakes118.exe windows:4 windows x86 arch:x86
93b5201d57470bdee489ff3f4140bac0
Code Sign
41:32:b4:4e:fd:d3:8a:50:bd:ff:3a:42:d1:e2:1e:9fCertificate
IssuerCN=Root ddddddNot Before10/12/2009, 11:58Not After31/12/2039, 23:59SubjectCN=kol.sdppp,O=y,1.2.840.113549.1.9.1=#130e6b696c77656f66646a662e6f706f6f:92:b7:48:14:35:0e:96:9c:91:0f:50:aa:d9:b7:dc:29:ee:d2:9eSigner
Actual PE Digest6f:92:b7:48:14:35:0e:96:9c:91:0f:50:aa:d9:b7:dc:29:ee:d2:9eDigest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
ReadProcessMemory
WriteProcessMemory
CreateProcessA
GetModuleFileNameA
GetCurrentProcess
SetThreadContext
ResumeThread
GetThreadContext
advapi32.dll�
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
msvcrt.dll�
malloc
fclose
??3@YAXPAX@Z
fread
fseek
fopen
free
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cw Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CBtrl Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE