Static task
static1
Behavioral task
behavioral1
Sample
27f7d87925eb647ef5ddbf2d3e08f2e3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
27f7d87925eb647ef5ddbf2d3e08f2e3_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
27f7d87925eb647ef5ddbf2d3e08f2e3_JaffaCakes118
-
Size
47KB
-
MD5
27f7d87925eb647ef5ddbf2d3e08f2e3
-
SHA1
61266d58e45e34597efbb9dde4b14403661ed6a4
-
SHA256
df0d0066e11b264d2db92d0d37a50cd06c5b699c920da88cbda4e941b9a49520
-
SHA512
d964eaa8d65cf85a650dd9c4963826932153d4ebf850c8136c2282fe5be59a46224cc3977535d2a090c3cb847b929551ba6490714606eacda24ea17d69aec3e6
-
SSDEEP
384:t+oLFWAdnNGtM5sDy1ZX5uVEqFcVCLz07kJ/CMVfvG+xwCcjnj5:ttkAXsgmVRvQAJ6MVfvGRj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27f7d87925eb647ef5ddbf2d3e08f2e3_JaffaCakes118
Files
-
27f7d87925eb647ef5ddbf2d3e08f2e3_JaffaCakes118.exe windows:4 windows x86 arch:x86
5cfda2c61f2e1fc918be5e4cc6632481
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetTempPathA
GetTickCount
CloseHandle
WriteFile
CreateFileA
GetModuleFileNameA
MoveFileA
GetSystemInfo
GetVersionExA
FreeLibrary
FreeResource
SizeofResource
LoadResource
GetCurrentThreadId
GetStartupInfoA
GetModuleHandleA
Sleep
GetCurrentDirectoryA
ExitProcess
user32
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
GetInputState
PostThreadMessageA
GetMessageA
wsprintfA
FindWindowA
PostMessageA
OpenWindowStationA
shell32
ShellExecuteA
msvcrt
_except_handler3
__set_app_type
__p__fmode
__p__commode
_strrev
_adjust_fdiv
_controlfp
__setusermatherr
_initterm
strcpy
strlen
memset
sprintf
??3@YAXPAX@Z
memcpy
??2@YAPAXI@Z
_exit
_XcptFilter
exit
_acmdln
__getmainargs
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_win Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE