Static task
static1
Behavioral task
behavioral1
Sample
2a61cc034536baf2a9631c9a370d3089_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2a61cc034536baf2a9631c9a370d3089_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2a61cc034536baf2a9631c9a370d3089_JaffaCakes118
-
Size
2.7MB
-
MD5
2a61cc034536baf2a9631c9a370d3089
-
SHA1
e2e30a2e21c0289be7863faf958295fa61365d89
-
SHA256
6cea40c2dac005952ac8d9ed3768358c9c90d62a7232570e708f258c48de5930
-
SHA512
1f34b0558899b3625b189e5dca67dc8a3f4841583b004287bd6451a382eae0d718ccfc52373420b259e38c5aa4585ad9feee42ea95aff808ace772a3411b82ad
-
SSDEEP
49152:ryAnNv+b5wjL1IYz2j/7yVnawkMNVKTgesLQLCEV2Er3xDt:ryAnsb56LFzsyawzN8gFna26xDt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a61cc034536baf2a9631c9a370d3089_JaffaCakes118
Files
-
2a61cc034536baf2a9631c9a370d3089_JaffaCakes118.exe windows:5 windows x86 arch:x86
c4c8be3ecedec9ae703de79e5f9995e8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenMutexA
VirtualAllocEx
GetFileAttributesExA
FindFirstVolumeMountPointA
ReadConsoleA
GetBinaryTypeW
VirtualAlloc
GetCommandLineA
SetHandleCount
DeleteAtom
VirtualAllocEx
GetExitCodeThread
LocalUnlock
SetConsoleMenuClose
GetVolumePathNameA
GetCommMask
GetEnvironmentVariableA
SetProcessPriorityBoost
GetEnvironmentStringsA
HeapAlloc
user32
GetTitleBarInfo
DlgDirListComboBoxW
GetClientRect
SetMessageExtraInfo
GetAncestor
SystemParametersInfoA
IsClipboardFormatAvailable
DefWindowProcA
GetWindowDC
TileChildWindows
GetMenuBarInfo
TranslateAcceleratorA
TranslateMessage
CreateIconFromResource
MenuItemFromPoint
SetScrollInfo
SetCursorContents
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 17.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ