Static task
static1
Behavioral task
behavioral1
Sample
9213073f63c1542315acdad27c0b8b78_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9213073f63c1542315acdad27c0b8b78_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
9213073f63c1542315acdad27c0b8b78_JaffaCakes118
-
Size
360KB
-
MD5
9213073f63c1542315acdad27c0b8b78
-
SHA1
77b5765cd37ccfb7608611291d66e68b7d68e2dc
-
SHA256
1356acd718a156e106163e91fa87a415e4f6855606d2712d8408d65190a95dad
-
SHA512
9ae5d76345825b0cd012d4ce8189a1b6864b3d76be93ae7fad22eb28387097346213d7763a989098ae2dd5a921afd3ab8ef72cc308d4d9bfc8e7e7efa3a92735
-
SSDEEP
6144:YaaRWvS8RStjunQ/ocbbOeEQZlPX6kKhWbyFqoMU2sEEbsOI/4Yi:YFWvNS8EE4+WOeU22bnI/4Yi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 9213073f63c1542315acdad27c0b8b78_JaffaCakes118
Files
-
9213073f63c1542315acdad27c0b8b78_JaffaCakes118.exe windows:4 windows x86 arch:x86
9db09ebe469b71e3c2a82229fc807185
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
msvcrt
memcpy
pdh
PdhReadRawLogRecord
kernel32
GetProcAddress
lstrlenW
GetCommandLineW
TerminateProcess
CreateThread
GetNumberFormatW
UnmapViewOfFile
SetEvent
OpenFileMappingW
GetModuleHandleA
FreeLibrary
MapViewOfFile
GetCurrentProcessId
GetLastError
VirtualQuery
LocalAlloc
GetExitCodeProcess
GetCurrentThreadId
CreateEventW
UnhandledExceptionFilter
VirtualProtect
FreeConsole
user32
GetClassNameA
GetShellWindow
Sections
.text Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 275KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
O_8!Iz Size: 148KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 148KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ