Static task
static1
Behavioral task
behavioral1
Sample
0918e688e5589c2b53bc1cd14c16b498_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0918e688e5589c2b53bc1cd14c16b498_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0918e688e5589c2b53bc1cd14c16b498_JaffaCakes118
-
Size
199KB
-
MD5
0918e688e5589c2b53bc1cd14c16b498
-
SHA1
bf984c4a3de9253037e7e46b49cf63ce20e0f63c
-
SHA256
bf1600afadda32a056e6299b4a6fe5c2e3e3795d25b1a1571d3db7efcf022360
-
SHA512
6429cf346631b3fbb32f007fdbbfd335e30e5948476c1ba6e63ec640eb8016efa4f0f2344bf17492e08b8159d7decdc1eb59342d9996253098b2f14d897ab15a
-
SSDEEP
3072:eHFcj+gfTbGZlmU3LZwmCitel3fX82iVSPvx8+:elcj+g3oRPw3fdiE++
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0918e688e5589c2b53bc1cd14c16b498_JaffaCakes118
Files
-
0918e688e5589c2b53bc1cd14c16b498_JaffaCakes118.exe windows:4 windows x86 arch:x86
35d0b87455ab405274c8abac2ec4ccd1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyA
lstrcatA
GetSystemDirectoryA
TerminateProcess
ResumeThread
SetThreadContext
WriteProcessMemory
GetProcAddress
LoadLibraryA
GetModuleHandleA
lstrcmpiA
GetModuleFileNameA
ReadProcessMemory
GetThreadContext
CreateProcessA
ExitProcess
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
WideCharToMultiByte
MultiByteToWideChar
OutputDebugStringA
DeleteFileA
MoveFileA
FreeResource
lstrlenA
WriteFile
SizeofResource
SetFileTime
LocalFileTimeToFileTime
FindFirstFileA
CreateFileA
LoadResource
FindResourceA
GetTickCount
GetTempPathA
SetLastError
GetWindowsDirectoryA
HeapFree
HeapAlloc
GetProcessHeap
GetLastError
ReadFile
SetFilePointer
GetPrivateProfileStringA
WritePrivateProfileStringA
CreateDirectoryA
GetFileAttributesA
SetUnhandledExceptionFilter
GetCommandLineA
Sleep
CreateThread
WinExec
GetCurrentThreadId
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
ntdll
RtlUnwind
strstr
strchr
strlen
memcpy
memset
ZwUnmapViewOfSection
_strcmpi
msvcrt
_initterm
_controlfp
__set_app_type
??2@YAPAXI@Z
__CxxFrameHandler
realloc
malloc
??3@YAXPAX@Z
rand
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
__p__fmode
__setusermatherr
_adjust_fdiv
__p__commode
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 182KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ