Static task
static1
Behavioral task
behavioral1
Sample
10ab5ec4d116cd03a99c5023f1b39323_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
10ab5ec4d116cd03a99c5023f1b39323_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
10ab5ec4d116cd03a99c5023f1b39323_JaffaCakes118
-
Size
37KB
-
MD5
10ab5ec4d116cd03a99c5023f1b39323
-
SHA1
54e4d417120330db8fd972cc0e280c404b3be1c9
-
SHA256
498a74880c02cf34fcd34d2db09ba1d7717aef61c0056650a1248828c236e47f
-
SHA512
14dc2235841064634fd44ec50d862e18d9a77216f0e80f1fb885fef77d7f8212670f9323fb874298858d80e5450fedc2e444afea6ac36b2022aca51289b2d2aa
-
SSDEEP
768:aWpSyNFIhok5I0A4Ce9NifIL4DRd4/fLI0Yr7Jz+5v39FYBB9GXDSM2EHIW:/Sy3Ge0A4Ce9RWxnr7JzGvtUODSMpHIW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 10ab5ec4d116cd03a99c5023f1b39323_JaffaCakes118
Files
-
10ab5ec4d116cd03a99c5023f1b39323_JaffaCakes118.exe windows:4 windows x86 arch:x86
8a71d90964cfaa2b6ed7a385eaf97dda
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
WinExec
lstrlenA
lstrcatA
GetProcAddress
GetModuleHandleA
GetEnvironmentVariableA
IsBadReadPtr
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
Sleep
GetFullPathNameA
CopyFileA
lstrcpyA
DeleteFileW
ExpandEnvironmentStringsA
LoadLibraryA
lstrlenW
VirtualFreeEx
CreateDirectoryA
GetSystemDirectoryA
lstrcpyW
lstrcatW
MultiByteToWideChar
GetVersionExA
GetModuleFileNameA
CreateFileMappingA
MapViewOfFile
SetLastError
UnmapViewOfFile
GetFileSize
SetFilePointer
ReadFile
LocalAlloc
CloseHandle
LocalFree
VirtualFree
VirtualAlloc
user32
CharUpperA
MessageBoxA
advapi32
RegSetValueExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyA
imagehlp
CheckSumMappedFile
ntdll
NtSetSystemInformation
RtlInitUnicodeString
NtCreateFile
ZwLoadDriver
NtDeleteFile
RtlUnwind
psapi
EnumProcessModules
GetModuleBaseNameA
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE