Static task
static1
Behavioral task
behavioral1
Sample
ebb92c875bfe26c0adf90e39b8b936e7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ebb92c875bfe26c0adf90e39b8b936e7_JaffaCakes118.exe
Resource
win10v2004-20240319-en
General
-
Target
ebb92c875bfe26c0adf90e39b8b936e7_JaffaCakes118
-
Size
284KB
-
MD5
ebb92c875bfe26c0adf90e39b8b936e7
-
SHA1
29bf73b1a9dca27856eade18681e030e1d93ed81
-
SHA256
0c478a49069c12ceec1fcc1774c26d191198fe7f52edd3504d8e992cb1af9e45
-
SHA512
98df37ac3a67c1b0aabeed97a3c1bc60c52a7f73e159e0a6c5d717c2cca5177db934b6a50b4159a95ad6e0ca9ce7c328851992f0de9cec585468cea962920e2e
-
SSDEEP
3072:G7PVw+K+oBEGKTt892s72L9lPWrfzZaNH8mhdo9uMDZAc87:6Vw+K+6KTtC2s72L9lPEfzgeDZc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ebb92c875bfe26c0adf90e39b8b936e7_JaffaCakes118
Files
-
ebb92c875bfe26c0adf90e39b8b936e7_JaffaCakes118.exe windows:4 windows x86 arch:x86
a9bb4f56cbb18407dd25d08aa534bf30
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryA
GetModuleFileNameA
DeleteFileA
WriteFile
GetProcAddress
GetModuleHandleA
CreateProcessA
GetStartupInfoA
CopyFileA
ReadFile
CreateThread
lstrcpyA
TerminateThread
GetCommandLineA
GetCurrentProcessId
GetWindowsDirectoryA
GetLocaleInfoA
VirtualQuery
GetSystemInfo
VirtualProtect
GetCurrentThreadId
QueryPerformanceCounter
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
SetFilePointer
SetConsoleCtrlHandler
FlushFileBuffers
SetStdHandle
CreateFileA
GetFileSize
CloseHandle
GetTickCount
Sleep
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
RtlUnwind
FreeLibrary
GetProcessHeap
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapAlloc
SetEndOfFile
ExitProcess
GetCurrentProcess
TerminateProcess
InterlockedIncrement
OutputDebugStringA
InterlockedDecrement
GetStdHandle
GetLastError
LoadLibraryA
GetVersionExA
RaiseException
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetSystemTimeAsFileTime
DebugBreak
user32
GetMessageA
TranslateMessage
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
PostQuitMessage
SetTimer
PostMessageA
FindWindowA
KillTimer
ExitWindowsEx
DefWindowProcA
DispatchMessageA
advapi32
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegDeleteValueA
ws2_32
htons
bind
listen
accept
shutdown
closesocket
recv
send
sendto
gethostbyname
inet_addr
connect
WSAAsyncSelect
inet_ntoa
WSACleanup
WSAStartup
ntohl
ntohs
recvfrom
select
WSASocketA
socket
setsockopt
mpr
WNetAddConnection2A
WNetCancelConnection2A
wininet
InternetOpenUrlA
InternetOpenA
InternetGetConnectedState
InternetReadFile
InternetCloseHandle
Sections
pcs1 Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pcs2 Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pcs3 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE