Static task
static1
Behavioral task
behavioral1
Sample
e94ca1154d3207197c63d840a94e2931_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e94ca1154d3207197c63d840a94e2931_JaffaCakes118.exe
Resource
win10v2004-20231215-en
General
-
Target
e94ca1154d3207197c63d840a94e2931_JaffaCakes118
-
Size
96KB
-
MD5
e94ca1154d3207197c63d840a94e2931
-
SHA1
a734164cce8d28bc41862939fef8a6d5db14eb14
-
SHA256
4dda01807744cdc0362e8f5b7e79bf39483916bbdeb6565b2d898c487cb90a8a
-
SHA512
70a60eda3c01f68d8366da6a18383584920197800235235673c4aa16f3216d6e24e9de65bee58de70706203abf7572a6e00f13bf45374d4d282dbccaa741c627
-
SSDEEP
1536:UR5VxYqFpMxMu/uiuFf5o75/eaoe2klarL:8xYE8S5o75/Noe2gE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e94ca1154d3207197c63d840a94e2931_JaffaCakes118
Files
-
e94ca1154d3207197c63d840a94e2931_JaffaCakes118.exe windows:4 windows x86 arch:x86
c8bad8ed85a3bdecdaeb75efbcaf5e41
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFileAttributesA
CreateFileA
ReadFile
HeapAlloc
UnmapViewOfFile
FlushViewOfFile
SetFilePointer
LocalFree
LocalUnlock
WriteProcessMemory
GetProcAddress
LoadLibraryA
ReadProcessMemory
GetCurrentProcess
GetModuleHandleA
LocalLock
LocalAlloc
HeapFree
CreateDirectoryA
DeleteFileA
GetFileAttributesA
FindNextFileA
FindFirstFileA
GetLogicalDrives
SetEndOfFile
GetLastError
CreateFileW
GetWindowsDirectoryW
GlobalLock
GetFileSize
GetDriveTypeA
FindNextFileW
FindFirstFileW
DeleteFileW
SetFileAttributesW
Process32Next
TerminateProcess
GetExitCodeProcess
Process32First
CreateToolhelp32Snapshot
OpenProcess
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CreateFileMappingA
MapViewOfFile
WriteFile
CloseHandle
GetVersionExA
GetProcessHeap
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
CreateThread
GlobalAlloc
Sleep
advapi32
QueryServiceStatus
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenServiceA
ControlService
RegCreateKeyExA
RegSetValueExA
RegCloseKey
CreateServiceA
StartServiceA
RegDeleteValueA
ChangeServiceConfigA
QueryServiceConfigA
SetServiceStatus
CloseServiceHandle
OpenSCManagerA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
shell32
ShellExecuteA
ws2_32
WSAStartup
recv
send
closesocket
connect
htons
socket
sendto
htonl
inet_addr
ntohl
accept
recvfrom
__WSAFDIsSet
select
listen
bind
user32
ExitWindowsEx
Sections
.text Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ