Static task
static1
Behavioral task
behavioral1
Sample
01bd4bd35e8558f03e77ef2cdff57a66_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
01bd4bd35e8558f03e77ef2cdff57a66_JaffaCakes118
-
Size
192KB
-
MD5
01bd4bd35e8558f03e77ef2cdff57a66
-
SHA1
5198d226eb7dcc19074c8ded9c0be3d7ae0ee2d9
-
SHA256
d28150062212ba9e243994942b46c7e691d18770549691cd3b2850d00c3a0de6
-
SHA512
2ff47a67da95e4a8d0203d4c767bf81c750344d157c42e3d95bd0b520c934df14be3833c7f1211a7fe870deebce71c80e3a206cf5b0296449626efc351b8cb28
-
SSDEEP
3072:afnH665zswbx4UHYlB8va5Uo85WIiJo332avVdI9gAhBSzBnWJZpM4:afH66VNb7HYlz5Uo85WI733Zdd5Y8BnQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 01bd4bd35e8558f03e77ef2cdff57a66_JaffaCakes118
Files
-
01bd4bd35e8558f03e77ef2cdff57a66_JaffaCakes118.exe windows:4 windows x86 arch:x86
4d64777eabd704b1c84b9e02d27a695b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GetLastError
CreateDirectoryA
DeleteFileA
SetFileAttributesA
GetFileAttributesA
GetSystemDirectoryA
GetCurrentThreadId
GetCurrentThread
GetProcAddress
LoadLibraryA
Sleep
GetModuleHandleA
ExitProcess
GetModuleFileNameA
GetTempPathA
MoveFileA
WriteFile
GetCurrentProcessId
WaitForSingleObject
OpenEventA
CreateEventA
SleepEx
GetShortPathNameA
ExpandEnvironmentStringsA
IsBadReadPtr
ExitThread
GetTickCount
GetExitCodeThread
CreateThread
SetUnhandledExceptionFilter
GetCommandLineA
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
msvcrt
srand
strstr
strrchr
strncpy
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_controlfp
_except_handler3
malloc
memcpy
_ftol
__CxxFrameHandler
_strlwr
_strupr
_itoa
_stricmp
Sections
.etxt Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdat Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ