Static task
static1
Behavioral task
behavioral1
Sample
f68d649836c237c001f9e83ac2cf7bfc_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f68d649836c237c001f9e83ac2cf7bfc_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f68d649836c237c001f9e83ac2cf7bfc_JaffaCakes118
-
Size
398KB
-
MD5
f68d649836c237c001f9e83ac2cf7bfc
-
SHA1
a1fb4e2af931a7c47aff6c5a3f28ade10e1784f5
-
SHA256
4ed1260750eea86f197f2445a56a45ce67f5ff60664cce4878bb27cf43e3aec0
-
SHA512
893b14fee74c7b982b3f94c4c3c9cc5d83bd2445600d06a7172f20546fe233c30f488841167c7d2672c7ac2cdf7820b9f74356d29a70b9bbb15361d1d16cf29c
-
SSDEEP
6144:tpriiS6Dyk7P2uImQAt3smT6t/lKTNbyIKWtkKmTjiQh6MV/4rK0Sz/7U1MNg2TQ:tdiFs7Imh7SCN92KSGe5uK0WYOpu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f68d649836c237c001f9e83ac2cf7bfc_JaffaCakes118
Files
-
f68d649836c237c001f9e83ac2cf7bfc_JaffaCakes118.exe windows:4 windows x86 arch:x86
3904af592f212a02a1c473cbf2071673
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
TerminateProcess
LoadResource
GetModuleFileNameA
GetProcAddress
VirtualAlloc
HeapReAlloc
InitializeCriticalSectionAndSpinCount
TlsSetValue
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapAlloc
HeapDestroy
GetCurrentThreadId
GetCurrentProcess
GetModuleHandleA
FreeLibraryAndExitThread
lstrcpyW
GetTempFileNameW
InterlockedExchange
RtlUnwind
GetSystemTime
QueryPerformanceCounter
VirtualQuery
LoadLibraryA
WritePrivateProfileStructW
OpenSemaphoreA
OpenProcess
VirtualAllocEx
ExitProcess
GetTickCount
GetLogicalDrives
advapi32
RegDeleteKeyA
CryptSignHashW
CryptHashSessionKey
RegQueryMultipleValuesW
LookupAccountNameA
CryptGenRandom
RegEnumKeyA
RegDeleteValueA
RegQueryValueExA
RegQueryValueA
RegOpenKeyExW
StartServiceA
RevertToSelf
CryptSetProvParam
RegFlushKey
RegQueryInfoKeyA
LookupPrivilegeNameA
DuplicateToken
Sections
.text Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ