Static task
static1
Behavioral task
behavioral1
Sample
ea05af5530430d7e353cf3503e13ae26_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ea05af5530430d7e353cf3503e13ae26_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ea05af5530430d7e353cf3503e13ae26_JaffaCakes118
-
Size
160KB
-
MD5
ea05af5530430d7e353cf3503e13ae26
-
SHA1
ebf05819a986206ae1c115396ca783a9e5c61963
-
SHA256
9b228301fd0f95c625825eafd0366899a36332840a44a758b897dddc623c4493
-
SHA512
231d9bfd8f273caae0650b662a3e87c2c65a65679bd7b5e0fe623d87a59aaf05133de4b751a1bd79f7e25a929e6960700d10ccf35641daac01f024d57775b0ed
-
SSDEEP
1536:ZKc67nJNxLkiQ62wamADcvjKMEt5or39Jy:Z4DfdfQ+PADcbKME5oj90
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea05af5530430d7e353cf3503e13ae26_JaffaCakes118
Files
-
ea05af5530430d7e353cf3503e13ae26_JaffaCakes118.exe windows:4 windows x86 arch:x86
1a42ffbbc71559042eeeb1d384910088
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
GetVersionExA
lstrcmpiA
GetModuleHandleA
GetModuleFileNameA
CopyFileA
GetTickCount
CreateThread
Sleep
CloseHandle
TerminateThread
LCMapStringA
SetStdHandle
FlushFileBuffers
HeapReAlloc
VirtualAlloc
HeapAlloc
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
GetStringTypeW
GetStringTypeA
HeapValidate
IsBadReadPtr
IsBadWritePtr
SetConsoleCtrlHandler
GetLastError
MultiByteToWideChar
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
LCMapStringW
advapi32
RegQueryValueExA
OpenEventLogA
ClearEventLogA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
mpr
WNetCancelConnectionA
WNetAddConnection2A
wsock32
socket
htons
inet_addr
connect
closesocket
WSAStartup
WSACleanup
gethostbyname
gethostname
ioctlsocket
netapi32
NetApiBufferFree
Sections
.text Size: 132KB - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ