Static task
static1
Behavioral task
behavioral1
Sample
2ead824c2424c82ebeb668a4c760c7ec_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2ead824c2424c82ebeb668a4c760c7ec_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2ead824c2424c82ebeb668a4c760c7ec_JaffaCakes118
-
Size
61KB
-
MD5
2ead824c2424c82ebeb668a4c760c7ec
-
SHA1
16ee79a1223fe301b7236d05cf6cd64d599b078d
-
SHA256
2c5ee3c30fc0913d48c2694f0b07463f0c1fc1036d4bc8fee4b7b68e4966ff82
-
SHA512
b67a17ecc37b3af48c2eb7544e41d2e97493af74fa2e5da10ff4ca004cd4122db07cabcd3b080a7e18c19515a64fb31db0e2e4babacdf66737bca42172b3687e
-
SSDEEP
1536:F72WsfaXYGIVTgVgeG3MCLrkvLOf9e+uCHD:FK2KvFrkDOf9e+uoD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ead824c2424c82ebeb668a4c760c7ec_JaffaCakes118
Files
-
2ead824c2424c82ebeb668a4c760c7ec_JaffaCakes118.exe windows:4 windows x86 arch:x86
fb13aeb767683e6ef383210104854e54
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapSize
GetVersion
DeleteAtom
WaitForSingleObject
VirtualAlloc
SetLastError
CloseHandle
SuspendThread
CreateFileA
GetStdHandle
SetLastError
GetFileSize
GetModuleHandleA
GetCurrentDirectoryA
DeleteFileA
EnterCriticalSection
GetEnvironmentVariableA
SetFileAttributesW
SetEndOfFile
ExitProcess
ReadFile
FindAtomW
GetFileAttributesA
GetCommandLineA
IsBadReadPtr
cryptui
LocalEnrollNoDS
CryptUIWizImport
LocalEnroll
WizardFree
CryptUIWizBuildCTL
DllUnregisterServer
WizardFree
DllRegisterServer
CryptUIStartCertMgr
CryptUIWizDigitalSign
CryptUIWizExport
CryptUIDlgViewContext
CryptUIDlgFreeCAContext
winrnr
NSPStartup
NSPStartup
NSPStartup
NSPStartup
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 10B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 54KB - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nonjlen Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE