Static task
static1
Behavioral task
behavioral1
Sample
e28662af562eda04eed538749857b82a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e28662af562eda04eed538749857b82a_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e28662af562eda04eed538749857b82a_JaffaCakes118
-
Size
236KB
-
MD5
e28662af562eda04eed538749857b82a
-
SHA1
c3fdc007f9cbf33b23baa9be9767a5646d1642ac
-
SHA256
19db7de5d179ea4f736657ecae37c78dcf6dfc33394587d8b9dec6afcce820de
-
SHA512
e11a63501edc3e723f761d927ecccf92836fd8d5ee01732236b98c1feba5c5ab1922dbe32597ccd810f167fd584ea8dbab1d35b6980c6b9bda9196a4d4f0d623
-
SSDEEP
3072:yXMhLPgOby2pJ6suUDNxEu4rZXbJqhoaZAYMNa95Zj6pDeu79QW4MawsCHVz+v5D:yEP9dEsuUD4uOM1kuW4TwsW4Rm2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e28662af562eda04eed538749857b82a_JaffaCakes118
Files
-
e28662af562eda04eed538749857b82a_JaffaCakes118.exe windows:4 windows x86 arch:x86
f6f3288f04f18e8e8a33689f9686d5a3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
sinet
NE_SendSoftware
NE_SendIPAddress
NE_EnumDeviceState
NE_CheckVersion
NE_DeleteXAB
NE_EnableBootService
NE_NewXABBroadcast
NE_NewXABComm
NE_GetSensorData
NE_GetDevCap
NE_CheckNETApiVersion
wsock32
gethostname
gethostbyname
ioctlsocket
inet_addr
htonl
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
sifiledb
FDB_GetDataBaseInfo
FDB_CheckVersion
FDB_Open
FDB_Close
sifileio
ord2
ord3
sixabctl
XC_TakeImage
XC_NewXABCtl
XC_DelXABCtl
XC_CheckVersion
siutil
WriteErrorLog
UTL_CheckVersion
ngswupdate
SW_SwUpdate
SW_ImgRead
SW_ImgSrc
sipanctl
PC_ReqNetWorkInfo
PC_ReqDevCaps
PC_DisconnectService
PC_UDPNetWorkConfigAck
PC_UDPDisconnect
PC_UDPConnect
PC_ReqSWUpdate
PC_UDPNetWorkConfig
PC_ReqNetWorkConfig
PC_UDPReqNetWorkInfo
PC_ConnectService
PC_ReqSWUpdateCancel
PC_SWUpdateImgSrc
PC_SetNotifyWndService
PC_CheckVersion
PC_ReqSetP2kNetWorkName
PC_ReqSaveNetWorkConfig
mfc42
ord269
ord826
ord600
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord537
ord800
ord823
ord1907
ord2575
ord6055
ord1776
ord4396
ord5290
ord4837
ord3402
ord4424
ord3574
ord5161
ord5162
ord5160
ord4905
ord4742
ord4976
ord4948
ord4358
ord5265
ord4377
ord4854
ord4998
ord2514
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5287
ord3798
ord4835
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord609
ord768
ord860
ord540
ord567
ord489
ord825
ord2370
ord2302
ord4258
ord1168
ord939
ord941
ord858
ord6334
ord3092
ord1768
ord4710
ord1871
ord3663
ord4234
ord4853
ord5280
ord3597
ord641
ord324
ord1200
ord2645
ord4376
ord802
ord542
ord2614
ord6569
ord940
ord5601
ord3790
ord1577
ord2818
ord4277
ord4129
ord922
ord2765
ord5609
ord397
ord699
ord4188
ord3438
ord5631
ord912
ord5856
ord2642
ord793
ord3719
ord3525
ord6093
ord4033
ord5981
ord2784
ord4278
ord924
ord2764
ord5572
ord3337
ord3811
ord2915
ord4224
ord2864
ord3874
ord2107
ord2289
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord616
ord2582
ord4402
ord3370
ord3640
ord693
ord686
ord384
ord6905
ord6199
ord3301
ord1085
ord6907
ord5710
ord1146
ord2862
ord2096
ord2408
ord3742
ord818
ord665
ord1979
ord5186
ord354
ord3176
ord6153
ord4673
ord4274
ord6375
ord4486
ord2554
ord1576
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord815
ord561
ord2528
ord1008
ord4204
ord1199
ord1205
ord5683
ord2621
ord2725
ord3698
ord765
ord2379
ord861
ord2863
ord6877
ord6358
ord2763
ord3812
ord3089
ord4160
ord2393
ord5575
ord1656
ord2140
ord434
ord2919
ord2097
ord6028
ord4243
ord3293
ord3910
ord3721
ord795
ord4083
ord6215
ord2652
ord1669
ord2086
ord692
ord2841
ord5450
ord6394
ord5440
ord6383
ord1908
ord1690
ord5288
ord4439
ord2054
ord4431
ord771
ord496
ord4259
ord2882
ord4715
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord3803
ord3318
ord3499
ord3177
ord2515
ord355
ord1575
ord1176
ord1116
ord535
ord2512
msvcrt
strncpy
_mbscmp
_mbsicmp
strtok
fwrite
fclose
fopen
strncmp
strlen
strcmp
isdigit
atoi
localtime
time
toupper
getenv
strcat
atol
memcpy
sprintf
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
memset
_purecall
strcpy
_EH_prolog
__CxxFrameHandler
_itoa
wcslen
_CxxThrowException
_setmbcp
kernel32
WritePrivateProfileSectionA
GetPrivateProfileIntA
CreateDirectoryA
Sleep
WritePrivateProfileStringA
lstrcmpA
lstrlenA
lstrcatA
lstrcpyA
CreateFileA
GetVersionExA
DeleteFileA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetTempPathA
lstrlenW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
GetDateFormatA
CopyFileA
GetStartupInfoA
GetModuleHandleA
LocalAlloc
LocalFree
InterlockedDecrement
GetTickCount
GlobalAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
GetComputerNameA
OpenFile
CloseHandle
GetModuleFileNameA
user32
GetMenuItemCount
EnableWindow
GetMenuState
GetParent
SendMessageA
GetMenuStringA
MessageBeep
KillTimer
PostMessageA
GetSystemMetrics
GetSubMenu
GetMenuItemID
ModifyMenuA
SetTimer
GetClientRect
LoadIconA
SetForegroundWindow
IsWindowVisible
wsprintfA
CharToOemA
gdi32
CreateFontIndirectA
GetStockObject
DeleteObject
GetObjectA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
shell32
ShellExecuteA
comctl32
ImageList_ReplaceIcon
ole32
CLSIDFromProgID
oleaut32
GetErrorInfo
SetErrorInfo
CreateErrorInfo
VariantClear
VariantInit
SysAllocString
VariantChangeType
SysFreeString
Sections
.text Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE