Static task
static1
Behavioral task
behavioral1
Sample
eaec4ede22a6e1cfb8c6dc3da65a168c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eaec4ede22a6e1cfb8c6dc3da65a168c_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
eaec4ede22a6e1cfb8c6dc3da65a168c_JaffaCakes118
-
Size
22KB
-
MD5
eaec4ede22a6e1cfb8c6dc3da65a168c
-
SHA1
bd1219578954cd8a1d316f1c86657eaf410f0d10
-
SHA256
bb16fccbee96091f9ce414762ae4f83366eb5c19bcefad6a04469eea95e19e02
-
SHA512
35cfd1e5ed7e5c64c541803673da3f799b6362052ab7a5343d32fec5287ecdc5499b1a75e366d50ef40d240b43f75cfa9cb256ff6b046087d4c117bbc5c2b83f
-
SSDEEP
384:E4b/3moOnAtNYy/i7zWNH58VSklnqhuFu0Pba3b/vrqGWW/8AoWT:jqQCVSmqcFY7jqGcA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eaec4ede22a6e1cfb8c6dc3da65a168c_JaffaCakes118
Files
-
eaec4ede22a6e1cfb8c6dc3da65a168c_JaffaCakes118.exe windows:4 windows x86 arch:x86
df2a2bc1b8a451185acaad52641c12ee
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
WaitForSingleObject
CreateThread
Sleep
lstrcmpiA
GetModuleFileNameA
GetSystemDirectoryA
lstrcatA
GetWindowsDirectoryA
DeleteFileA
GetVersionExA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetTempFileNameA
GetTempPathA
lstrlenA
GetTickCount
CreateProcessA
ReadFile
SetFilePointer
CreateFileA
WriteFile
CloseHandle
SystemTimeToTzSpecificLocalTime
GetCurrentProcess
CreateMutexA
lstrcpyA
user32
wsprintfA
GetWindow
GetClassNameA
GetWindowTextA
GetForegroundWindow
advapi32
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
LookupPrivilegeValueA
wininet
InternetOpenUrlA
InternetOpenA
InternetReadFile
DeleteUrlCacheEntry
InternetCloseHandle
HttpQueryInfoA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
msvcrt
sprintf
_ltoa
_strlwr
strstr
fopen
fgets
fclose
strcpy
strcat
strlen
strchr
malloc
memset
memcpy
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls0 Size: 512B - Virtual size: 390B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.reloc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ