Static task
static1
Behavioral task
behavioral1
Sample
ce8c638bcb21b94d8fac0d827734685e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ce8c638bcb21b94d8fac0d827734685e_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ce8c638bcb21b94d8fac0d827734685e_JaffaCakes118
-
Size
146KB
-
MD5
ce8c638bcb21b94d8fac0d827734685e
-
SHA1
d322c83c1f3ea95bb26fdf5e23ccf6116a0cff9e
-
SHA256
eecd633aa202e8c3e4920606811a9ce25f52112faf2e84faaf4fe7df4da5602d
-
SHA512
1453e7f5810e2dbf76154a56231d0a217ecdd5e449260e58866e6795997ebd22da6d6996a1dddbed2afb7a325cfe6af71e90b879cd106776f74080becf3a15af
-
SSDEEP
3072:0gqxL1ONor6sPaYP7Z5lchUxutLNK/eoU:wL1ONor6sPN3lcjNn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce8c638bcb21b94d8fac0d827734685e_JaffaCakes118
Files
-
ce8c638bcb21b94d8fac0d827734685e_JaffaCakes118.exe windows:4 windows x86 arch:x86
972d5a7597dbb90494fada153be16dcb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileA
SetFileAttributesA
GetSystemDirectoryA
GetModuleFileNameA
Sleep
TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
DeleteFileA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
CreateFileA
SetStdHandle
SetConsoleCtrlHandler
RtlUnwind
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapAlloc
ReadFile
GetFileType
SetHandleCount
FlushFileBuffers
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
SetFilePointer
InterlockedIncrement
GetLastError
MoveFileA
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
SetEndOfFile
user32
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
TranslateMessage
RegisterClassExA
LoadCursorA
LoadIconA
SetTimer
DispatchMessageA
LoadStringA
GetForegroundWindow
GetWindowTextA
DestroyWindow
PostQuitMessage
DefWindowProcA
CreateWindowExA
ShowWindow
UpdateWindow
shell32
ShellExecuteA
wsock32
send
recv
connect
htons
closesocket
gethostbyname
ioctlsocket
socket
WSACleanup
WSAStartup
Sections
.text Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ