Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_3b29383007fb7037bab2fdd8fa9e34e5.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_3b29383007fb7037bab2fdd8fa9e34e5
-
Size
169KB
-
MD5
3b29383007fb7037bab2fdd8fa9e34e5
-
SHA1
01ff35d931c930fdad49f5d1057ed4bf36905744
-
SHA256
17c875fb6b85948075d5be4f6f887780fd1a28d901174b3a96a43bd478f2b738
-
SHA512
42ee6c866a609869c01682e17b221de5a3968e37ad0fa80afa202aa3bff6184227d07424993536b257a44c5b6736fcff11253f87bfb32ddaea9e8e5c7df574f1
-
SSDEEP
3072:LQ9X812u2T/BjSkLKlkyHtzuRe4xvkrBlOCkGacw2bIQ1yDGb3VAFBnpurFrNgm4:LQIEjSOe6RIWCkGx0D63uF5EZBZPiqCD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_3b29383007fb7037bab2fdd8fa9e34e5
Files
-
JaffaCakes118_3b29383007fb7037bab2fdd8fa9e34e5.exe windows:4 windows x86 arch:x86
f21db0441805839d792d1637e19f1bfe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
AddAtomW
GetModuleFileNameA
IsBadCodePtr
GetThreadLocale
GetFileAttributesA
IsBadReadPtr
LCMapStringA
VirtualProtect
GetStartupInfoA
GetLocaleInfoA
SetHandleCount
WideCharToMultiByte
SetUnhandledExceptionFilter
GetCPInfo
GetOEMCP
FindFirstFileA
TerminateProcess
FlushFileBuffers
LCMapStringW
GetStringTypeW
GetVersionExA
CreateFileA
EnumResourceNamesA
FreeEnvironmentStringsW
HeapSize
ReadFile
GetEnvironmentStringsW
WriteFileGather
TlsSetValue
SetStdHandle
GetFileType
TlsGetValue
GetFullPathNameA
GetCurrentProcess
UnhandledExceptionFilter
GetStringTypeA
FreeEnvironmentStringsA
GetEnvironmentStrings
GetStdHandle
GetACP
WriteFile
SetFilePointer
GetDiskFreeSpaceA
advapi32
RegEnumKeyA
RegOpenKeyA
RegEnumKeyExA
RegQueryValueA
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegCloseKey
lz32
LZCopy
LZClose
LZOpenFileA
setupapi
CM_Get_Depth
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status
Sections
.text Size: 93KB - Virtual size: 484KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ