Static task
static1
Behavioral task
behavioral1
Sample
022c8f93d17c333c4233f4ccb0698401_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
022c8f93d17c333c4233f4ccb0698401_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
022c8f93d17c333c4233f4ccb0698401_JaffaCakes118
-
Size
17KB
-
MD5
022c8f93d17c333c4233f4ccb0698401
-
SHA1
8755cd5213eaaff7db81b8d2f9abdcff6a257830
-
SHA256
db49aeea596103f183e86bf57c18bc9890fdbab27b0d3270b8769ae007a6f883
-
SHA512
8088aad4ffdb64b65f824fb33e78475ca6c6071ab2baf91dc135e51f248d2e8eece95e5b798e16257234586ede22f5f1f2e9c6cc16a0464792476bcc2c07acce
-
SSDEEP
192:TXZdDxC4nEQR3mRnVdNP1oynunWZO0Tlk66II5flBBpPKLVZxyquM6JcekAAiZg3:DZPTP3mRnVL1QBulvNQBB08DkAAiS6h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 022c8f93d17c333c4233f4ccb0698401_JaffaCakes118
Files
-
022c8f93d17c333c4233f4ccb0698401_JaffaCakes118.exe windows:4 windows x86 arch:x86
b8f8579b2dd41ffb53abd1fd63bea584
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
WinExec
GetCurrentProcessId
CopyFileA
DeleteFileA
WaitForSingleObject
TerminateProcess
OpenProcess
GetCommandLineA
CloseHandle
GetModuleFileNameA
GetTempPathA
CreateRemoteThread
GlobalLock
GlobalAlloc
WriteProcessMemory
VirtualAllocEx
GetProcAddress
LoadLibraryA
GetStartupInfoA
GetModuleHandleA
FindResourceA
VirtualProtectEx
SizeofResource
LoadResource
LockResource
Sleep
CreateThread
user32
FindWindowExA
FindWindowA
SendMessageA
advapi32
RegOpenKeyExA
RegCloseKey
RegSetValueExA
winmm
mixerSetControlDetails
mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen
msvcrt
strlen
_controlfp
_except_handler3
__set_app_type
memcpy
memset
fclose
fseek
fwrite
fopen
sprintf
strncpy
sscanf
strchr
strcpy
strrchr
_stricmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 412B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ