Static task
static1
Behavioral task
behavioral1
Sample
0cf47da72d0bca545a6ae5cc3c888db3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0cf47da72d0bca545a6ae5cc3c888db3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0cf47da72d0bca545a6ae5cc3c888db3_JaffaCakes118
-
Size
2.6MB
-
MD5
0cf47da72d0bca545a6ae5cc3c888db3
-
SHA1
f133fdc6b0473fca9e1a2f1d50596138ddebe0c0
-
SHA256
c4ec65638f645c851e3a5f1e438b25e18c48025e67b806f900739a6a3e224f23
-
SHA512
8c6a9cebd2015ef06452a4e2865b68c6be14c5bd80f0f00460732c5ed946b11b561e86f69ea56f234d04fa13addde1cd9ab5bee80c8163f609b2415a08eb795f
-
SSDEEP
49152:dnqjOEu95vbQ22Sj03UnCRq+psIzX0/wTfCtVBD8rFLowsrEal7YC8FvjNBae:d8OLzzOAnCM+pt70/ofCL9qux7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0cf47da72d0bca545a6ae5cc3c888db3_JaffaCakes118
Files
-
0cf47da72d0bca545a6ae5cc3c888db3_JaffaCakes118.exe windows:4 windows x86 arch:x86
e60a1d415a4c8598282399ed52deede8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CreateStreamOnHGlobal
comctl32
ImageList_SetIconSize
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
wsock32
WSACleanup
Sections
CODE Size: - Virtual size: 721KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 622KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 5KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TenBase0 Size: - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 161KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TenBase1 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TenBase2 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ