Static task
static1
Behavioral task
behavioral1
Sample
0a87a96a81f11da7945315187edae7f9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0a87a96a81f11da7945315187edae7f9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0a87a96a81f11da7945315187edae7f9_JaffaCakes118
-
Size
12KB
-
MD5
0a87a96a81f11da7945315187edae7f9
-
SHA1
2aea72a7b9a77d238a6fa1b6962a1799c08ef24f
-
SHA256
ea8e7c892a593c1a3677f87ce7b1bd52c29cf29b20d7ee25fbe124468cf780cb
-
SHA512
bb142d39d7b3b5ea26805304023212606a8dcbc15d18173849b46ad5ee8f7ce29827dc44d1b20f95f83f4f6e805afbc23181870915b6f7b941c2aabaa84b67be
-
SSDEEP
192:QTCe3iiDtUAlZq+QlMu6Xy1VKYdOZfkDuLBXLc9vpY5NK+KNC5xw4DCYk:UiG3NXyLqkDy5LWvpUD5x5DCYk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a87a96a81f11da7945315187edae7f9_JaffaCakes118
Files
-
0a87a96a81f11da7945315187edae7f9_JaffaCakes118.exe windows:4 windows x86 arch:x86
6ff6c4673ba501f92936a7de066dde9b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
OpenProcess
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetModuleFileNameA
lstrcpynA
CloseHandle
FreeLibrary
GetCurrentThreadId
DeleteFileA
MoveFileA
TerminateProcess
VirtualQuery
GetLastError
Sleep
GetCommandLineA
GetStartupInfoA
msvcrt
strcpy
_strupr
strcmp
strlen
malloc
free
memset
strcat
strstr
strchr
memmove
__mb_cur_max
_pctype
_isctype
atol
__set_app_type
_controlfp
exit
advapi32
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptDecrypt
user32
PostThreadMessageA
PeekMessageA
GetWindowTextA
EnumWindows
wininet
InternetSetCookieA
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
HttpQueryInfoA
InternetReadFile
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE