Static task
static1
Behavioral task
behavioral1
Sample
0dff48ba5e0bc943c6b866c4b0260ddb_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0dff48ba5e0bc943c6b866c4b0260ddb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0dff48ba5e0bc943c6b866c4b0260ddb_JaffaCakes118
-
Size
282KB
-
MD5
0dff48ba5e0bc943c6b866c4b0260ddb
-
SHA1
f75ebf7ce60e4c4d7acaf3601de5076bf1b66faa
-
SHA256
0e364714974d1cc88ac61af2590490a9379c184ddbf2b2b79bc33b484b07fa78
-
SHA512
e719b95082ad5c5ee6ccd0037c96e0be5b553a606524b274b44fd316c7b8b24f9076acd9c056c0961e8cf0365f444a1ad9e5df001509277176e217ab519eb43b
-
SSDEEP
6144:/G9ubON2uPf1ad4h3nCkiTx5f+EPWlmsdb4:/GwbfuPfzsLN5flObdc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0dff48ba5e0bc943c6b866c4b0260ddb_JaffaCakes118
Files
-
0dff48ba5e0bc943c6b866c4b0260ddb_JaffaCakes118.exe windows:4 windows x86 arch:x86
c8810b7931a29451109743411aed2b1e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
FindResourceA
UnmapViewOfFile
FlushViewOfFile
DeleteFileA
VirtualFree
VirtualAlloc
GetModuleHandleA
lstrcpyA
GetModuleFileNameA
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
TerminateProcess
Sleep
LoadResource
SetFilePointer
SetStdHandle
HeapAlloc
HeapFree
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
WideCharToMultiByte
GetEnvironmentStringsW
GetEnvironmentStrings
FlushFileBuffers
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
GetOEMCP
GetACP
GetCPInfo
ExitProcess
LockResource
GetFileSize
CreateFileMappingA
MapViewOfFile
GetWindowsDirectoryA
CreateFileA
GetVersion
GetCommandLineA
WriteFile
GetLocalTime
CloseHandle
GetLastError
GetStartupInfoA
MultiByteToWideChar
user32
FindWindowA
SendMessageA
shell32
ShellExecuteA
Sections
.text Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 184KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
�������� Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE