Static task
static1
Behavioral task
behavioral1
Sample
23c863fa391e350465d2f30099c5baf1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
23c863fa391e350465d2f30099c5baf1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
23c863fa391e350465d2f30099c5baf1_JaffaCakes118
-
Size
241KB
-
MD5
23c863fa391e350465d2f30099c5baf1
-
SHA1
417845a781e2cf5973578823b3652e077c710797
-
SHA256
a80649adf8365314ce5bac0242734bbab8f66d0035b44b306a60cbaa516808c5
-
SHA512
426bb9be752d9e5d64f18798f901c43a1a6cc564a647523c90a8023d9def793d3648dca59a3697eee064fc3e99e9858f0e0865d91bdcc58077f33c492e284971
-
SSDEEP
3072:dS3fSoF58hgOYal4oM2JeJhjkrOqp9CNVh4a2YJTcmqB2b1zSOkTLlpFgiyzy:ehOYguMeJhQtEh92ETcDB2b4nxc+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23c863fa391e350465d2f30099c5baf1_JaffaCakes118
Files
-
23c863fa391e350465d2f30099c5baf1_JaffaCakes118.exe windows:5 windows x86 arch:x86
8d039c3a4ff2f7b15acf76180063cee2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wtsapi32
WTSVirtualChannelPurgeInput
WTSEnumerateServersA
WTSUnRegisterSessionNotification
WTSSetUserConfigW
WTSEnumerateProcessesA
WTSEnumerateSessionsW
WTSVirtualChannelQuery
WTSQuerySessionInformationA
WTSLogoffSession
WTSRegisterSessionNotification
WTSFreeMemory
dsprop
CheckADsError
CrackName
FindSheet
ErrMsg
user32
LoadIconA
LoadBitmapW
InsertMenuA
CreateDesktopA
GetWindowTextA
DrawTextW
IsWindow
GetClassLongA
PostMessageW
GetMonitorInfoW
CharPrevW
CreateWindowExA
kernel32
FindFirstVolumeA
lstrcpy
GetModuleFileNameA
ReadConsoleA
OpenEventA
GetProcessHeap
WriteFile
GetGeoInfoA
LoadLibraryA
WaitForSingleObject
GetLogicalDriveStringsW
FindFirstFileA
GetProcAddress
EncodePointer
LoadLibraryExA
CreateMutexW
Sections
.text Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ