Static task
static1
Behavioral task
behavioral1
Sample
ff385b7e5e0f12522df921662fd11fc4_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ff385b7e5e0f12522df921662fd11fc4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ff385b7e5e0f12522df921662fd11fc4_JaffaCakes118
-
Size
52KB
-
MD5
ff385b7e5e0f12522df921662fd11fc4
-
SHA1
16f55c31106e36b1b05e6d9e2e5f79d0f3d6989f
-
SHA256
db96b7fb5e9aaeded6c16ff014a66b2a8aa31723ce01673b1ea9e89a6694d295
-
SHA512
5f7e89be256bdc3c22c3fa64d5219e88e431c756231ebeae182aeae74a5b8cb16d60166e331541f93b79f2f9e5a2bd94e1a07c6ec0b31a130fe8df1bb62301f1
-
SSDEEP
768:5Lopjm3J30ZKhfybClYh6oiFYMBFTt845vlhhd3UwcnHu1Zd/:CJZKhKelXoiu8Zy45sns/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff385b7e5e0f12522df921662fd11fc4_JaffaCakes118
Files
-
ff385b7e5e0f12522df921662fd11fc4_JaffaCakes118.exe windows:4 windows x86 arch:x86
d78381b545f0d81f977d3ad37492884a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
HeapReAlloc
HeapAlloc
GetOEMCP
GetACP
GetCPInfo
WriteFile
RtlUnwind
HeapFree
VirtualFree
CreateEventA
Sleep
GetLastError
CopyFileA
VirtualAlloc
GetSystemDirectoryA
HeapCreate
HeapDestroy
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStringTypeW
user32
DestroyWindow
PostQuitMessage
SetTimer
PostMessageA
KillTimer
DefWindowProcA
FindWindowA
LoadIconA
RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
LoadCursorA
gdi32
GetStockObject
advapi32
RegSetValueExA
RegCloseKey
RegOpenKeyExA
shell32
ShellExecuteA
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ