Static task
static1
Behavioral task
behavioral1
Sample
255d97957385468a646caeb2379bc015_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
255d97957385468a646caeb2379bc015_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
255d97957385468a646caeb2379bc015_JaffaCakes118
-
Size
194KB
-
MD5
255d97957385468a646caeb2379bc015
-
SHA1
7ef76aa721ffb0b3698dbcff79562074fb006daa
-
SHA256
dca066f97948a112be4e71d428317e3af09601a126673ed0be5f0a9168e90850
-
SHA512
c0c20c0727a9c44316a2cc11cdfdf8f70dce630ec5293a64b617427662cb6cb4fdd4b39a546a84bcf04a267b0365dd56b4f78d2612149ad890529576afba82f9
-
SSDEEP
3072:a5vlug8VrNHfUrpPKC+8QxyOE5uPzIyV4e5dkTBfRP28P:a5vlkrNcr1KL8OEkIyVP5dkTBJO8P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 255d97957385468a646caeb2379bc015_JaffaCakes118
Files
-
255d97957385468a646caeb2379bc015_JaffaCakes118.exe windows:5 windows x86 arch:x86
2384298c815de0bb093e7d3b1f234ce5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
strcmp
memset
_chkstk
memcmp
strcpy
_snprintf
strlen
memcpy
_strcmpi
_vsnprintf
RtlRandom
RtlAdjustPrivilege
strstr
_strlwr
kernel32
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
OpenProcess
CreateRemoteThread
Process32Next
VirtualQueryEx
HeapAlloc
GetProcessHeap
HeapFree
HeapValidate
GetTickCount
GetWindowsDirectoryA
OutputDebugStringA
GetCurrentThreadId
GetLastError
ExitProcess
VirtualProtect
CloseHandle
GetModuleFileNameA
CreateMutexA
SetLastError
VirtualAlloc
GetProcAddress
LoadLibraryA
IsBadReadPtr
VirtualFree
ReadProcessMemory
WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
VirtualFreeEx
user32
GetDesktopWindow
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ