Static task
static1
Behavioral task
behavioral1
Sample
f7ede4315ac864a6ee98609b1d5313d2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f7ede4315ac864a6ee98609b1d5313d2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f7ede4315ac864a6ee98609b1d5313d2_JaffaCakes118
-
Size
1.8MB
-
MD5
f7ede4315ac864a6ee98609b1d5313d2
-
SHA1
637b597c6e1448c97980e081994aafdc4c3159ba
-
SHA256
5c6c6019283a22b8e2202d88a8d9ca6c4f87f3154945bb07a5db5b23071c9e53
-
SHA512
2552c0d8302fae497e3903f7946996dd971ace822392df60279c23a6cc05607c2743d23b7fc3c5af68ec97b81cb043e35d06d28683ed4b4b16e432268b84ef3f
-
SSDEEP
24576:h5iYzJqnXGaUVsdan5OcHnOSE65Jp6EbNlHAqSakgEl7YifVbs+Ll4Se7hCm2:/ilusd+OaGALtNlgqSMI77u+B4SUYm2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f7ede4315ac864a6ee98609b1d5313d2_JaffaCakes118
Files
-
f7ede4315ac864a6ee98609b1d5313d2_JaffaCakes118.exe windows:4 windows x86 arch:x86
c54ad15a6d31accad9cf49f805949eba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
AddAtomA
FindFirstFileA
IsBadReadPtr
MulDiv
LoadLibraryA
GetEnvironmentStringsW
lstrcatA
GetEnvironmentStrings
GetFileAttributesA
lstrcpyA
WideCharToMultiByte
WriteFile
IsBadCodePtr
lstrcmpA
FreeEnvironmentStringsA
ReadFile
GetStringTypeW
GetDiskFreeSpaceA
GetStringTypeA
GetCPInfo
SetFilePointer
DeleteCriticalSection
VirtualProtect
SetStdHandle
Sleep
SetUnhandledExceptionFilter
GetCurrentThreadId
GetModuleHandleA
GetTickCount
CreateFileA
EnumResourceNamesW
lstrcmpiA
GetOEMCP
LCMapStringA
GetProcAddress
InitializeCriticalSection
CloseHandle
FreeEnvironmentStringsW
FlushFileBuffers
GetLastError
lstrlenA
lstrcpynA
FreeLibrary
GetThreadLocale
UnhandledExceptionFilter
EnterCriticalSection
GetStartupInfoA
GetFullPathNameA
LCMapStringW
lstrlenA
LeaveCriticalSection
MultiByteToWideChar
RaiseException
setupapi
CM_Get_Global_State
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
Sections
.text Size: 828KB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1014KB - Virtual size: 1014KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ