Static task
static1
Behavioral task
behavioral1
Sample
e38d12bf573472a77285224c9ebddc38_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e38d12bf573472a77285224c9ebddc38_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
e38d12bf573472a77285224c9ebddc38_JaffaCakes118
-
Size
168KB
-
MD5
e38d12bf573472a77285224c9ebddc38
-
SHA1
02f9fab051c166a4a355d481c7434863d3fe1755
-
SHA256
54b791f301da47e0f636b50e687e5b8911dacc04a6d9ca905dd98165da93db65
-
SHA512
8ab4a68e8909bb36881f959dc8a0e570d73cee0acf1d75f94beb06fd99c2941eb2856e9585cd0da8d0c3904a3bae40f361a43805c014e53f05ffedbac963971d
-
SSDEEP
3072:z9x66a+uVm3THhbB7Nu3oyaw+0NraoPbpdwPtMgyYbsbvdIsQXSH+1zvGEW:CxdVm3bXOd+0oqH8tltQH+B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e38d12bf573472a77285224c9ebddc38_JaffaCakes118
Files
-
e38d12bf573472a77285224c9ebddc38_JaffaCakes118.exe windows:4 windows x86 arch:x86
8eac91b04361e882136c597c6d5330eb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
RtlUnwind
Sleep
GetThreadPriority
InterlockedIncrement
GetVersionExA
CloseHandle
IsValidLocale
IsDebuggerPresent
CreateFileA
WideCharToMultiByte
WriteFile
LeaveCriticalSection
SetupComm
GetLastError
GetModuleFileNameW
GetConsoleOutputCP
GetLocaleInfoW
HeapReAlloc
TerminateProcess
GetCurrentThreadId
WriteConsoleA
GetCPInfo
GetCurrentProcess
InitializeCriticalSection
EnumSystemLocalesA
GetProcessHeap
SetEndOfFile
GetCommandLineA
SetUnhandledExceptionFilter
HeapAlloc
EnumResourceNamesA
GlobalAlloc
GetProcAddress
SetStdHandle
UnhandledExceptionFilter
MultiByteToWideChar
RaiseException
LCMapStringA
WriteConsoleW
ExitProcess
ExitProcess
ReadFile
GetFullPathNameW
HeapFree
EnterCriticalSection
DeleteCriticalSection
InterlockedDecrement
LCMapStringW
GetCurrentDirectoryW
IsValidCodePage
GetModuleHandleA
GetUserDefaultLCID
HeapSize
GetFullPathNameA
user32
GetAncestor
MessageBoxW
shell32
SHFileOperationW
SHCreateDirectoryExW
SHGetFolderPathW
rpcrt4
UuidCreate
Sections
.text Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ