Static task
static1
Behavioral task
behavioral1
Sample
e75458e36d088e5f901cdd5a2508299d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e75458e36d088e5f901cdd5a2508299d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e75458e36d088e5f901cdd5a2508299d_JaffaCakes118
-
Size
458KB
-
MD5
e75458e36d088e5f901cdd5a2508299d
-
SHA1
7593d5b29614fb4f7ee076ec539471484de790d3
-
SHA256
7c119fd6b169f44a4c1f376028ba6bb4fafd2905113322574a8191df3b5686c8
-
SHA512
deeba2bf5bdb3c80e2180dcf71b91d4aeb2bc595276d23730579f93d1f9066d756637a8672c75fade395d74f969259fa3c37b762a4da4017327d6cb18461e2c8
-
SSDEEP
12288:OiDKWEM7VB+wyNBxRq4tRnt9nNoDtnlYk:OiDKWEE3+wyNBW4Tnt9nU/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e75458e36d088e5f901cdd5a2508299d_JaffaCakes118
Files
-
e75458e36d088e5f901cdd5a2508299d_JaffaCakes118.exe windows:4 windows x86 arch:x86
335ae45a4b1bc1aaf634d5d89b3e0c25
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
user32
SetTimer
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
kernel32
WideCharToMultiByte
CreateThread
EnterCriticalSection
LeaveCriticalSection
GetLogicalDriveStringsA
Sleep
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
MultiByteToWideChar
GetUserDefaultLCID
GetOEMCP
CreateFileA
GetFileSize
ReadFile
CreateDirectoryA
GetCommandLineA
GetModuleHandleA
FreeLibrary
LoadLibraryA
LCMapStringA
CloseHandle
GetProcAddress
GetNativeSystemInfo
ReleaseMutex
CreateMutexA
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
advapi32
LookupAccountNameA
RegQueryValueExA
RegOpenKeyA
ConvertSidToStringSidW
IsValidSid
GetUserNameA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
ole32
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
ws2_32
getpeername
getsockname
accept
listen
bind
htons
ntohs
inet_addr
WSACleanup
recv
send
connect
socket
WSAStartup
inet_ntoa
closesocket
shlwapi
PathFileExistsA
dnsapi
DnsQuery_A
shell32
SHGetSpecialFolderPathA
msvcrt
_strnicmp
malloc
free
memmove
modf
__CxxFrameHandler
strrchr
strncpy
tolower
_ftol
atoi
_CIfmod
strncmp
strchr
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
oleaut32
RegisterTypeLi
LoadTypeLi
VarR8FromBool
VarR8FromCy
SysFreeString
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
VariantChangeType
SafeArrayCreate
SafeArrayDestroy
VariantClear
SysAllocString
LHashValOfNameSys
Sections
.text Size: 444KB - Virtual size: 456KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE