Static task
static1
Behavioral task
behavioral1
Sample
d247b1143874dbbd753f09d1c998f0d6_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d247b1143874dbbd753f09d1c998f0d6_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d247b1143874dbbd753f09d1c998f0d6_JaffaCakes118
-
Size
193KB
-
MD5
d247b1143874dbbd753f09d1c998f0d6
-
SHA1
4652cfbc0dfc3a4305b4fed2bf9a285edfca5712
-
SHA256
b66aa491b8bc87ed8c8fc61a7d4f912be6c0ad686a27f9b5c970dafafcee25e1
-
SHA512
3b8e4604d44aca643d5b6552c23f86cc1be0ec28648b6faabc754681aa8468446c27e5fd61d11fa160744c9baa66c2fb2863041bfcd7bbd56d09b2d763803d95
-
SSDEEP
3072:sYdf45yb2XrpMhCLk5+BY7r12xCjAzdWqFb9y9VBP2clLIgL6kDRwDxQ2:lxzSX9Mcg5n7mAEI9vTLIY6kDh2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d247b1143874dbbd753f09d1c998f0d6_JaffaCakes118
Files
-
d247b1143874dbbd753f09d1c998f0d6_JaffaCakes118.exe windows:4 windows x86 arch:x86
99d8574af5a23871cf93c30e9cf4ad41
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CreateFiberEx
UpdateResourceW
GetFullPathNameW
DebugBreak
BeginUpdateResourceW
FindClose
GetFileAttributesW
SetFileAttributesA
ReadFile
lstrlenA
EscapeCommFunction
CreateDirectoryA
GetOEMCP
OutputDebugStringA
SetFileAttributesW
RemoveDirectoryA
CreateDirectoryW
EnumResourceNamesW
LoadLibraryExA
RemoveDirectoryW
GetFileAttributesA
LoadLibraryExW
CopyFileA
FatalExit
DeleteFileW
AreFileApisANSI
DeleteFileA
CopyFileW
GetFullPathNameA
EndUpdateResourceW
FreeLibrary
GetFileInformationByHandle
msvfw32
ICInfo
user32
MonitorFromWindow
wsprintfW
CharNextA
CharNextW
advapi32
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CryptHashData
CryptGetHashParam
CryptDestroyHash
imagehlp
ImageGetDigestStream
ImageRvaToVa
ImageNtHeader
ImageDirectoryEntryToData
psapi
GetProcessMemoryInfo
shell32
CommandLineToArgvW
Sections
.text Size: 176KB - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lib Size: 512B - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ