Static task
static1
Behavioral task
behavioral1
Sample
420aa3ea17df01eeab7f5c23a31351ac_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
420aa3ea17df01eeab7f5c23a31351ac_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
420aa3ea17df01eeab7f5c23a31351ac_JaffaCakes118
-
Size
44KB
-
MD5
420aa3ea17df01eeab7f5c23a31351ac
-
SHA1
a24a087c17c263842307ce4c9095784fffc66d44
-
SHA256
43bdfc24b0a190b97bdef3ae303220669683dc814f8ba90e3579813e4a27c4c7
-
SHA512
e5e4912842b0a24ce67c36f06199d9b0f7a80a9f8517ccea4838ab6535afdb01e7c360b4ebef7bab8421486ae1e4e25e5cb50b136c99cd18b7b5e2d5e3826743
-
SSDEEP
384:xFsdDb5hm995xgFEcKuLWKfMvVoyrbP0/Q6qfTvKSyYYCs9vFUPxQuk0o+SAreTk:kdb5hmd6+cXnfo2qfTKSHuFsKt0oe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 420aa3ea17df01eeab7f5c23a31351ac_JaffaCakes118
Files
-
420aa3ea17df01eeab7f5c23a31351ac_JaffaCakes118.exe windows:4 windows x86 arch:x86
fcc02ad99d43a25380163760732a3118
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
CloseHandle
GetCurrentProcess
VirtualFreeEx
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetCurrentDirectoryA
GetCurrentProcessId
GetLastError
GetProcAddress
LoadLibraryA
DisconnectNamedPipe
ReadFile
ConnectNamedPipe
SetEvent
CreateNamedPipeA
FreeLibrary
CreateEventA
CreateThread
GetModuleFileNameA
WaitForSingleObject
ExitProcess
TerminateProcess
HeapFree
HeapReAlloc
HeapAlloc
GetCommandLineA
GetVersion
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
RtlUnwind
WriteFile
FlushFileBuffers
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
Sections
.text Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE