Static task
static1
Behavioral task
behavioral1
Sample
d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118
-
Size
179KB
-
MD5
d0ba47b970fb65ef49b3b3c989dab7f5
-
SHA1
0ca01adac0e147aab06647c272a815010b953769
-
SHA256
acc481cc760cac57a034e9932d3f2d470c68f8df183963660a2009d650dc0b4b
-
SHA512
9676554802bbb428d8486708c273dd9f3764b5ad534c7d225aaa42d32b6e11130fef3e6bd0c5d501d3d088705ccecd2e2c0c592cf5ddedb4b3b4b0158dc5632a
-
SSDEEP
3072:Qvpp4K6gHfihdTAMqciIrCRSSINuE4uVmqfWVpkmvFbYdupGb3HSbtLnlr+6Z6nZ:yH46HfihdTAMsIrCvhE4uEqEvFbYdefX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118
Files
-
d0ba47b970fb65ef49b3b3c989dab7f5_JaffaCakes118.exe windows:4 windows x86 arch:x86
864ea17c6a1ed1afe57195812166feca
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetStringTypeW
LCMapStringW
FileTimeToSystemTime
GetLocalTime
CreateFiberEx
LocalAlloc
LocalFileTimeToFileTime
FindNextFileW
GetCurrentProcess
SetThreadAffinityMask
LoadResource
FileTimeToLocalFileTime
EnumResourceNamesW
GetShortPathNameW
GetOEMCP
CompareStringA
FindClose
SetCurrentDirectoryW
IsBadReadPtr
SetErrorMode
LocalFree
SetThreadPriority
SetEnvironmentVariableW
GetSystemDirectoryW
FindResourceW
SystemTimeToFileTime
FreeLibrary
FindFirstFileW
SearchPathW
mprapi
MprConfigServerDisconnect
MprConfigServerConnect
MprConfigGetFriendlyName
user32
SetCapture
IsWindowEnabled
InvalidateRgn
ValidateRect
EnableWindow
UpdateWindow
ReleaseCapture
DestroyWindow
RealGetWindowClassA
GetCapture
IsWindow
FlashWindow
ValidateRgn
ExcludeUpdateRgn
GetUpdateRgn
Sections
.text Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imul Size: 512B - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ