Static task
static1
Behavioral task
behavioral1
Sample
ecd56262cb3ca20c7d54fe69fbcb8863_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ecd56262cb3ca20c7d54fe69fbcb8863_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ecd56262cb3ca20c7d54fe69fbcb8863_JaffaCakes118
-
Size
48KB
-
MD5
ecd56262cb3ca20c7d54fe69fbcb8863
-
SHA1
d7c3f84f13a2b73a492ce17c18f4fe4b84600180
-
SHA256
0f4f5a1c83b4e7b3e0065b4e52364740f87d9d9c918786f0ee4dded5050f0357
-
SHA512
a16b15183c76708cbaaab69d621479118104574077b702237972b8450c5cdd5f84c3dc76c07df339260f3378f7ed034ba82eaa1f1e49be0d217c8f877775d475
-
SSDEEP
768:lQLV5ufBzfrkXQvcJOPO8jF1GHv506M/o:lQLLQvNm8jFSCo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ecd56262cb3ca20c7d54fe69fbcb8863_JaffaCakes118
Files
-
ecd56262cb3ca20c7d54fe69fbcb8863_JaffaCakes118.exe windows:4 windows x86 arch:x86
dc784dcc15f6db78243eb6f0bb3dcac0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
CloseHandle
CreateProcessA
DuplicateHandle
GetCurrentProcess
CreatePipe
ReadFile
TerminateProcess
WriteFile
lstrcpyA
lstrcatA
GetVersion
GetWindowsDirectoryA
GetModuleFileNameA
CreateThread
PeekNamedPipe
TerminateThread
LCMapStringA
SetEndOfFile
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
CreateFileA
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapFree
GetLastError
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
SetFilePointer
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
MultiByteToWideChar
LCMapStringW
advapi32
RegSetValueExA
RegCreateKeyA
ws2_32
inet_ntoa
recv
WSAStartup
closesocket
send
socket
htons
inet_addr
connect
Sections
.text Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE