Static task
static1
Behavioral task
behavioral1
Sample
17331349906bda354ed085e84fae3cb6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
17331349906bda354ed085e84fae3cb6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
17331349906bda354ed085e84fae3cb6_JaffaCakes118
-
Size
12KB
-
MD5
17331349906bda354ed085e84fae3cb6
-
SHA1
facd0a85fbbc1af2fef477d13fe12fbfa36c9dc1
-
SHA256
2f3a372e4fec2ce0757331f67672d6f35586f3a5eae0fc0d5d9dba444b5b775d
-
SHA512
82fe5428ca1ed894708e8131bef62b9ccb3e955259f4036ecc2eb6cf2cf59c34661d76e2432d046bda388d96840d48fc619063b518a8c6747149af88ba849b96
-
SSDEEP
192:rjwYQo4EDWM6F7nMrEFT+AqzfG4vRni8rb:HwYd4NMW7n++T+AcG4J5rb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17331349906bda354ed085e84fae3cb6_JaffaCakes118
Files
-
17331349906bda354ed085e84fae3cb6_JaffaCakes118.exe windows:4 windows x86 arch:x86
096c80c0d78678ff8a451b8a832c808e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
GetProcAddress
LoadLibraryA
GetLastError
GetModuleFileNameA
HeapFree
GetProcessHeap
WaitForMultipleObjects
CloseHandle
GetModuleHandleA
GetModuleHandleW
SetFileAttributesW
HeapAlloc
GetSystemDirectoryA
DeleteFileA
lstrlenA
lstrcmpA
ExitThread
ResetEvent
CreateThread
WaitForSingleObject
SetEvent
CreateEventA
CreateMutexA
WriteFile
CreateProcessA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
ReleaseMutex
lstrcpyA
CreateFileA
SizeofResource
LoadResource
FindResourceA
GetFileAttributesA
user32
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
CreateWindowExA
DestroyWindow
wsprintfA
CloseWindow
advapi32
RegSetValueExA
RegNotifyChangeKeyValue
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegCreateKeyExA
ole32
OleInitialize
OleUninitialize
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 748B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ