Static task
static1
Behavioral task
behavioral1
Sample
549fc6c288d910ea6b474f17de8cdfa3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
549fc6c288d910ea6b474f17de8cdfa3_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
549fc6c288d910ea6b474f17de8cdfa3_JaffaCakes118
-
Size
217KB
-
MD5
549fc6c288d910ea6b474f17de8cdfa3
-
SHA1
64a1a03e687a48214b49dbd9c783bb39e8744a6f
-
SHA256
0e356f74b4d14710d3bb75d3eb97893c69f68db3709e2e9f78f5f0c1c8f85aa7
-
SHA512
1568be494ff4bed70fff135b809654a41bb99ac7c2a5711876400fc170699ed47ac7809db7a69b1a4bb3a78e3dbdc52cbfc3bdedf0696edaedf8b0468c33c6f5
-
SSDEEP
3072:j5euuad47MKiA/1zEUqyfCjVV4SxEMTBfRCdsVgYus2JPcl8u:j5eusM4pEUojVV/xEMTBJeMXjJlD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 549fc6c288d910ea6b474f17de8cdfa3_JaffaCakes118
Files
-
549fc6c288d910ea6b474f17de8cdfa3_JaffaCakes118.exe windows:5 windows x86 arch:x86
2384298c815de0bb093e7d3b1f234ce5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
strcmp
memset
_chkstk
memcmp
strcpy
_snprintf
strlen
memcpy
_strcmpi
_vsnprintf
RtlRandom
RtlAdjustPrivilege
strstr
_strlwr
kernel32
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
OpenProcess
CreateRemoteThread
Process32Next
VirtualQueryEx
HeapAlloc
GetProcessHeap
HeapFree
HeapValidate
GetTickCount
GetWindowsDirectoryA
OutputDebugStringA
GetCurrentThreadId
GetLastError
ExitProcess
VirtualProtect
CloseHandle
GetModuleFileNameA
CreateMutexA
SetLastError
VirtualAlloc
GetProcAddress
LoadLibraryA
IsBadReadPtr
VirtualFree
ReadProcessMemory
WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
VirtualFreeEx
user32
GetDesktopWindow
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ