Static task
static1
Behavioral task
behavioral1
Sample
2a4fab485e3527f4ac0c76c4291e4d08_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2a4fab485e3527f4ac0c76c4291e4d08_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2a4fab485e3527f4ac0c76c4291e4d08_JaffaCakes118
-
Size
149KB
-
MD5
2a4fab485e3527f4ac0c76c4291e4d08
-
SHA1
68da008c52ac5b64d92373eb4da799098b0596a6
-
SHA256
9e0c18075ee1fe81e6407a27c8736274fd69eebf3eab40aa8ff96a22771fba5e
-
SHA512
79c73ce4c1c8966bb1a15e666705f257fa6a440f17f07420649107158762f1ed0eaf2b3e390faa7023dfba15b952d69b36ea671f2f779572409ba4726facdadd
-
SSDEEP
3072:KhJ+cGcQJz3zcVOueZAM+/GT8BH5b+o1ee:YEcGcQFc0u0AM++QBHr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a4fab485e3527f4ac0c76c4291e4d08_JaffaCakes118
Files
-
2a4fab485e3527f4ac0c76c4291e4d08_JaffaCakes118.exe windows:4 windows x86 arch:x86
b7384e4d01a995a7f27bd1ed6e031371
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaErase
__vbaEnd
__vbaDateVar
__vbaCyVar
__vbaCySgn
__vbaCyMul
__vbaCyI2
__vbaCyAbs
__vbaCheckTypeVar
__vbaCastObjVar
__vbaCastObj
__vbaAryVar
__vbaAryRebase1Var
kernel32
EnumResourceNamesA
lstrlenA
lstrcatA
VirtualFree
TlsAlloc
SetUnhandledExceptionFilter
SetLastError
SetCurrentDirectoryA
LeaveCriticalSection
GetStartupInfoA
GetModuleHandleA
GetLocalTime
GetCommandLineA
FlushFileBuffers
CloseHandle
ExitProcess
advapi32
LsaFreeMemory
RegOpenKeyExA
LsaGetRemoteUserName
LsaEnumerateAccountsWithUserRight
user32
IsCharLowerA
EndPaint
ActivateKeyboardLayout
GetWindowTextA
ole32
OleInitialize
CoInitialize
CoGetMalloc
OleUninitialize
CoGetClassObject
CoCreateGuid
CoUninitialize
CoCreateInstance
wininet
HttpEndRequestA
FindFirstUrlCacheEntryA
FindCloseUrlCache
dsound
DirectSoundCaptureCreate8
DirectSoundCaptureEnumerateW
DirectSoundCaptureEnumerateA
msvfw32
ICOpen
ICMThunk32
ICInstall
DrawDibStart
DrawDibSetPalette
Sections
.text Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 69KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ