Static task
static1
Behavioral task
behavioral1
Sample
0b3aa76ee8a8f414b628f144197dfcc4_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0b3aa76ee8a8f414b628f144197dfcc4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0b3aa76ee8a8f414b628f144197dfcc4_JaffaCakes118
-
Size
39KB
-
MD5
0b3aa76ee8a8f414b628f144197dfcc4
-
SHA1
9e945693378694d6a3230f871284e8c731e77bda
-
SHA256
1236022ac50f91a80006574ff5379fc9fb31dfa4a48d52fb6ace965551b63786
-
SHA512
a4c54a58c67522453c70765a01ab454b5e0fb8224e0e1d810a3e414aa686d41aac7019d545b63c43092ba414ce067b383e7148d1a3fa44cbf1671da4cded543c
-
SSDEEP
768:Ax9ZnlLH7mMYmMs8oyKKDcd2br8fWmuTo:A3Znl3mjs8dKKDcn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b3aa76ee8a8f414b628f144197dfcc4_JaffaCakes118
Files
-
0b3aa76ee8a8f414b628f144197dfcc4_JaffaCakes118.exe windows:4 windows x86 arch:x86
df74c8f289e675a5632bbbb73ae73946
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LockResource
LoadResource
FindResourceA
WinExec
GetTempPathA
GlobalAlloc
GetProcAddress
GetModuleHandleA
HeapFree
ReadFile
CreateFileA
GetProcessHeap
GetFileInformationByHandle
GetSystemDirectoryA
DuplicateHandle
GetCurrentProcess
LoadLibraryA
LocalFree
IsBadReadPtr
GetVersionExA
SizeofResource
WriteFile
CloseHandle
HeapAlloc
FreeResource
ExitProcess
TerminateProcess
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
RtlUnwind
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
advapi32
GetUserNameA
SetEntriesInAclA
SetSecurityInfo
GetSecurityInfo
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ