Static task
static1
Behavioral task
behavioral1
Sample
000233e0df94dce78f3e011aa7a0e4b1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
000233e0df94dce78f3e011aa7a0e4b1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
000233e0df94dce78f3e011aa7a0e4b1_JaffaCakes118
-
Size
64KB
-
MD5
000233e0df94dce78f3e011aa7a0e4b1
-
SHA1
3593c5e3e796968134db0091582d40c4160ed202
-
SHA256
48bd3699a584d5689afe81ec8df0bd8ac63653a1242ecb52b53efcb6c167c899
-
SHA512
5321bc4a3c1fac18d246cb1cd67ac85ccc0f2d3748fbaee0b298fedc5c0e90daca9a85276e8720124ab2c31420ebb90c112a123cc11e29857ef4feb4e6a5c0aa
-
SSDEEP
384:lqa10DFQ1WqYuu6j2DeB/6mJCtGJnyQTeRSWVWByuIFBKWJB:lqaODFq6F6WWSdwybSWQ6T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 000233e0df94dce78f3e011aa7a0e4b1_JaffaCakes118
Files
-
000233e0df94dce78f3e011aa7a0e4b1_JaffaCakes118.exe windows:4 windows x86 arch:x86
5204221228af933ad546170f5a0a939f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
WriteFile
GetTempPathA
CreateFileA
GetWindowsDirectoryA
CreateProcessA
CopyFileA
GetModuleFileNameA
ResumeThread
SetThreadPriority
GetCurrentThread
GetProcAddress
GetCurrentProcess
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
VirtualAllocEx
DeleteFileA
WriteProcessMemory
VirtualFreeEx
CreateRemoteThread
CreateEventA
GetLastError
CloseHandle
SetPriorityClass
GetStartupInfoA
GetModuleHandleA
advapi32
RegOpenKeyA
RegCreateKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegQueryValueA
msvcrt
strrchr
strstr
_strlwr
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strncpy
sprintf
_stricmp
Sections
.text Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ