Static task
static1
Behavioral task
behavioral1
Sample
56cfb48fa2c07e2fc9aa6145bdb59f3b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
56cfb48fa2c07e2fc9aa6145bdb59f3b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
56cfb48fa2c07e2fc9aa6145bdb59f3b_JaffaCakes118
-
Size
172KB
-
MD5
56cfb48fa2c07e2fc9aa6145bdb59f3b
-
SHA1
25f02e0118dd2bf2ebe9752b154ebab44730a988
-
SHA256
6d93297c01942bc322f488920605e86527d8224fb50981b1e51b3454484833db
-
SHA512
c20d7f2be9a9b594d86be8a1c6d93b44995014bc7bc0dd7fee272f2b93fc89b40ab3fe18e044c79333f76b04e5fc41a58729614b1e6dde66ff52fb9279fcbc7d
-
SSDEEP
3072:5ccdDfq0PiTySTl/v7o10/BmsoWrcANXGu6JBrgWETEkO4JIpuNyy1:5cCRPiTXR/Dq0/oWr3XrGr6TEkO4tNyM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 56cfb48fa2c07e2fc9aa6145bdb59f3b_JaffaCakes118
Files
-
56cfb48fa2c07e2fc9aa6145bdb59f3b_JaffaCakes118.exe windows:5 windows x86 arch:x86
782f0a71fa7e7cd60d0b434884ecbc49
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
NtCreateEvent
RtlUpcaseUnicodeString
RtlQueryInformationAcl
NtCreateFile
NtQueryVolumeInformationFile
NtWaitForSingleObject
RtlInitializeGenericTable
RtlWriteRegistryValue
_wcsupr
wcscpy
kernel32
InterlockedExchange
GetThreadLocale
InterlockedDecrement
GetProcessHeap
GetStdHandle
GetACP
GetLocalTime
InterlockedIncrement
GetCommandLineW
lstrlenA
VirtualProtect
SetEvent
GetModuleFileNameA
GetModuleHandleW
GetFileAttributesW
WriteFile
ulib
??1ARRAY@@UAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
msvcrt
wcscpy
_stricmp
_pctype
malloc
_XcptFilter
fputs
free
__setusermatherr
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ