Static task
static1
Behavioral task
behavioral1
Sample
b4eddf49f78487cb95c1c70fb99b7466_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b4eddf49f78487cb95c1c70fb99b7466_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
b4eddf49f78487cb95c1c70fb99b7466_JaffaCakes118
-
Size
165KB
-
MD5
b4eddf49f78487cb95c1c70fb99b7466
-
SHA1
8397938b050f4986d3adb174a37885e33ba379c6
-
SHA256
f41c9ee55a3ed50244bff0398fec752afeec914e231f0ad243faf25ccac5c46f
-
SHA512
04966b422269089a3fc49dc3cab5575f61966fbcaca3657337e3bf1e35c6cc1e2a5a7a71ca91c847aee76b56995b5165a256d92f812d7830810eb6f8da98c987
-
SSDEEP
3072:BQrKZJq6xU+6/TyJyxA2g+uAayxqytzQ:BFq63IHpuAPd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4eddf49f78487cb95c1c70fb99b7466_JaffaCakes118
Files
-
b4eddf49f78487cb95c1c70fb99b7466_JaffaCakes118.exe windows:4 windows x86 arch:x86
f8f329ec31ee4aac3457d15fce1dac1c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsDebuggerPresent
GetOEMCP
VirtualAlloc
RtlMoveMemory
OpenProcess
GetCommandLineW
VirtualFree
GetDriveTypeA
GetCurrentProcess
user32
CharNextA
GetDesktopWindow
Sections
.text Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Orohk. G Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ