Static task
static1
Behavioral task
behavioral1
Sample
429bb1e678d40398fdad1e020dc15ef4_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
429bb1e678d40398fdad1e020dc15ef4_JaffaCakes118
-
Size
363KB
-
MD5
429bb1e678d40398fdad1e020dc15ef4
-
SHA1
15f4ef22136aab10067889ac42bef5773004cc16
-
SHA256
e128b545323eb7e8db71dd728bf1fcca5ab1cadc68884df38cbe34f3444ec814
-
SHA512
30a76ca19e0f520ba614fa019a5e76d6b1bd34139fa6f8abb1cef8b3fa4187c048cd13b32d45b0d5cead06d3c9c3e9b9d6b6604ae2dc3e7874de7bdf46d8bfb4
-
SSDEEP
6144:cBBBeGi78mntmFmXA1BhK5IgksbSH3nEDFONk47nlP2ctHP17b44:cBBBU8mntmFFPhKQsbQ3EDXol3vBb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 429bb1e678d40398fdad1e020dc15ef4_JaffaCakes118 -
NSIS installer 1 IoCs
resource yara_rule sample nsis_installer_2
Files
-
429bb1e678d40398fdad1e020dc15ef4_JaffaCakes118.exe windows:4 windows x86 arch:x86
4da702f9b1d5061c0421b91bbacedc65
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32
GetKeyboardType
advapi32
RegQueryValueExA
oleaut32
SysFreeString
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
Sections
CODE Size: 35KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE