Static task
static1
Behavioral task
behavioral1
Sample
fd9d383877333890f869008754cf618e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd9d383877333890f869008754cf618e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fd9d383877333890f869008754cf618e_JaffaCakes118
-
Size
46KB
-
MD5
fd9d383877333890f869008754cf618e
-
SHA1
bd471dd470de6770887ab19965812ac078637083
-
SHA256
3ca2a3a42459cd3690e17983870f06c6d7f7a3723f90016a3dc9c8e2f943630d
-
SHA512
2eb031c246e0b5aa3c82a3205b7a14e0ec60fac33aa58df9cac1739923b0559c927497468501c3273cfe1b9c948ac7208661dd23703aedd1e0e2db7548f7ba54
-
SSDEEP
768:sb1BbHJYUf0SgMXRdLH0SsKSjQg1m11G9W/kYIB+kXWkduMsE7xPEpG0FwZejKq2:szbHJYU8VKzgkOmfIhDWpGFZemeHni
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd9d383877333890f869008754cf618e_JaffaCakes118
Files
-
fd9d383877333890f869008754cf618e_JaffaCakes118.exe windows:5 windows x86 arch:x86
4a1b94b7410965a885168ee95b92d500
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegDeleteValueA
CryptCreateHash
RegQueryValueExA
DuplicateTokenEx
CryptGetHashParam
CryptReleaseContext
shlwapi
PathRemoveFileSpecW
wvnsprintfW
wvnsprintfA
StrCmpNIA
SHDeleteKeyA
StrStrW
StrCmpNIW
wnsprintfA
wnsprintfW
PathFindFileNameW
PathMatchSpecW
PathCombineW
PathFileExistsW
Sections
.cvwf Size: 36KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zet Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.foduz Size: 5KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE