Static task
static1
Behavioral task
behavioral1
Sample
403f52f67bce9c609bdd3ba2111e47e0_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
403f52f67bce9c609bdd3ba2111e47e0_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
403f52f67bce9c609bdd3ba2111e47e0_JaffaCakes118
-
Size
196KB
-
MD5
403f52f67bce9c609bdd3ba2111e47e0
-
SHA1
a8257c2e5253a119410661a6c7b51e39c146ef6c
-
SHA256
d20c5a0213b85683880764c2dc99c58206b4a8fb93e14136454b14afc387b1a5
-
SHA512
ca9b9cc551999421de817d649a5368e6d9f135e666b4d65c62e11b3aa5c3a719eadf5fd04f2c3f990f60afae8494cec8e33d75f0e66c67c700b5b740ee255957
-
SSDEEP
6144:3qRjPxFxR04np8BT8j2oqCwX/mQiHxyiPo:a/F70Q8BsweQyxL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 403f52f67bce9c609bdd3ba2111e47e0_JaffaCakes118
Files
-
403f52f67bce9c609bdd3ba2111e47e0_JaffaCakes118.exe windows:4 windows x86 arch:x86
d2c66a3838f975419473bdaa5b2b5c6a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
TerminateProcess
WaitForSingleObject
OpenProcess
MultiByteToWideChar
GetVersionExA
GetCurrentProcess
SetFileTime
SystemTimeToFileTime
CreateFileA
WriteFile
ReadFile
GetFileSize
LockResource
LoadResource
SizeofResource
GetModuleHandleA
MoveFileA
DeleteFileA
ReadProcessMemory
LoadLibraryA
GetSystemWindowsDirectoryA
GetTempPathA
CreateProcessA
CopyFileA
Sleep
SetFileAttributesA
GetModuleFileNameA
GetProcAddress
GetLastError
GetProcessHeap
HeapAlloc
FindResourceA
HeapFree
SetEndOfFile
GetStringTypeW
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetCPInfo
GetACP
GetOEMCP
WideCharToMultiByte
LCMapStringA
LCMapStringW
SetFilePointer
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
GetStringTypeA
shell32
ShellExecuteA
SHGetSpecialFolderPathA
DoEnvironmentSubstA
shlwapi
PathFileExistsA
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE