Static task
static1
Behavioral task
behavioral1
Sample
38c685092bf6fcd179764611bb8eeefd_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
38c685092bf6fcd179764611bb8eeefd_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
38c685092bf6fcd179764611bb8eeefd_JaffaCakes118
-
Size
22KB
-
MD5
38c685092bf6fcd179764611bb8eeefd
-
SHA1
c896b190bfe59d0a0bf89a764e4923b90bb0187c
-
SHA256
1a20a4459d3f852dbd575689e1ecc78794184db86cfaba069f10c98397b88988
-
SHA512
fed80d1fafd22802fa563ca2bf65151f99ce1a4b84522d5929f445ae3058e98e1d616ef8d76637d1fbcd26255df584911f370767500c09b4956b2a79b3040a55
-
SSDEEP
384:EjJb/3moOnAtNYy/i7zWNH58VSklnqhuFu0Pba3b/vrqGWW/8AoWT:wjqQCVSmqcFY7jqGcA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38c685092bf6fcd179764611bb8eeefd_JaffaCakes118
Files
-
38c685092bf6fcd179764611bb8eeefd_JaffaCakes118.exe windows:4 windows x86 arch:x86
df2a2bc1b8a451185acaad52641c12ee
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
WaitForSingleObject
CreateThread
Sleep
lstrcmpiA
GetModuleFileNameA
GetSystemDirectoryA
lstrcatA
GetWindowsDirectoryA
DeleteFileA
GetVersionExA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetTempFileNameA
GetTempPathA
lstrlenA
GetTickCount
CreateProcessA
ReadFile
SetFilePointer
CreateFileA
WriteFile
CloseHandle
SystemTimeToTzSpecificLocalTime
GetCurrentProcess
CreateMutexA
lstrcpyA
user32
wsprintfA
GetWindow
GetClassNameA
GetWindowTextA
GetForegroundWindow
advapi32
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
LookupPrivilegeValueA
wininet
InternetOpenUrlA
InternetOpenA
InternetReadFile
DeleteUrlCacheEntry
InternetCloseHandle
HttpQueryInfoA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
msvcrt
sprintf
_ltoa
_strlwr
strstr
fopen
fgets
fclose
strcpy
strcat
strlen
strchr
malloc
memset
memcpy
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls0 Size: 512B - Virtual size: 390B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.reloc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ