Static task
static1
Behavioral task
behavioral1
Sample
K.5580367182669187.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
K.5580367182669187.exe
Resource
win10v2004-20240802-en
General
-
Target
fde1b4568562b193e67bc4200733aed1_JaffaCakes118
-
Size
629KB
-
MD5
fde1b4568562b193e67bc4200733aed1
-
SHA1
c68b88e1f1d6ffa0e47bc3b7241ce518093ce4ba
-
SHA256
5954881eaae980316f371646512f30439a54d7c4daceaf9535654dfa46870f43
-
SHA512
272009d0206cc2e500f54a3955b4581d3e5f910be78ac027647fb980991b81b0814334bcc7fec13b4a12faa364a4724e85331fc4f28c509cc7cd1096871f5195
-
SSDEEP
12288:Ebr85knDae+6fAq5bb1uhDwpxme1uoRWrRbz1UaCKtk0PN/i636:EpDae/f55bcPe1LWbUa5BPll36
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/K.5580367182669187.com
Files
-
fde1b4568562b193e67bc4200733aed1_JaffaCakes118.zip
-
K.5580367182669187.com.exe windows:5 windows x86 arch:x86
5320c32fa5b92d40af26784d8a06b50a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rsaenh
CPDecrypt
CPEncrypt
CPCreateHash
CPDeriveKey
kernel32
GetCurrentThreadId
LoadLibraryW
WriteConsoleA
GetShortPathNameW
CloseHandle
HeapAlloc
VirtualAlloc
OpenFileMappingW
CreateSemaphoreW
LoadLibraryA
CreateProcessA
OpenMutexW
lstrcmp
FindClose
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ydata Size: 660KB - Virtual size: 659KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ