Static task
static1
Behavioral task
behavioral1
Sample
52cde473d7537a3d4b83f232d6bf22f0_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
52cde473d7537a3d4b83f232d6bf22f0_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
52cde473d7537a3d4b83f232d6bf22f0_JaffaCakes118
-
Size
512KB
-
MD5
52cde473d7537a3d4b83f232d6bf22f0
-
SHA1
99b3b8c260d548d5a1efcf2acef91c6e566153c5
-
SHA256
7a2f3da523616199cf6372351f662acfc10570af822888651fd407940ff70dda
-
SHA512
55dc8b60f8dce44a53ac614906d619f0a15626eda3ed97322927558705a1b5259bf56bff6071d6ef414bb8b071674d677dd38b9c7db6e913d0260f29950a99e2
-
SSDEEP
12288:k7Lg6S2gYkyC5lmlHaFY8J9aPoYsEwPAHBooKSWVU:UEtX4lLo0uAHHC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52cde473d7537a3d4b83f232d6bf22f0_JaffaCakes118
Files
-
52cde473d7537a3d4b83f232d6bf22f0_JaffaCakes118.exe windows:5 windows x86 arch:x86
0c888e133105308885f3999fbfc70287
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
wsock32
__WSAFDIsSet
version
VerQueryValueW
winmm
timeGetTime
comctl32
ImageList_Remove
mpr
WNetCancelConnection2W
wininet
InternetReadFile
psapi
EnumProcesses
userenv
CreateEnvironmentBlock
user32
SetWindowPos
gdi32
DeleteObject
comdlg32
GetSaveFileNameW
advapi32
RegEnumValueW
shell32
DragQueryPoint
ole32
OleSetMenuDescriptor
oleaut32
SafeArrayAllocData
Sections
.text Size: 377KB - Virtual size: 952KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 133KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE