Static task
static1
Behavioral task
behavioral1
Sample
f1f66ceff7c7d77006daf517b86b2ea0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f1f66ceff7c7d77006daf517b86b2ea0_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f1f66ceff7c7d77006daf517b86b2ea0_JaffaCakes118
-
Size
14KB
-
MD5
f1f66ceff7c7d77006daf517b86b2ea0
-
SHA1
7ea3997e0b364964d7ed017cb09645fdde7d45a5
-
SHA256
d6a67d8847ed5de75e47867234edabcc75a19c72adbf621561fea12b8257f0d2
-
SHA512
dd8500a446598dae6ad42757da6bec417b07a7b3f43f7f081e37cee0565226ab44718b1b3af92a769b5413a0a0cadb693f36f21e47db0034964359da4289b2bb
-
SSDEEP
384:e2J+MMi8WCsRTlX+BZ3cbMRwTgXCv9VlNnvUXEATcT3tNgjPMA:e2Jki7/lX6JkMRxE93mXVTcT9NgjPt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f1f66ceff7c7d77006daf517b86b2ea0_JaffaCakes118
Files
-
f1f66ceff7c7d77006daf517b86b2ea0_JaffaCakes118.exe windows:1 windows x86 arch:x86
6d56fd4a0d79da74e86c7329a1122a0f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
WSACleanup
WSAStartup
closesocket
connect
gethostbyname
gethostname
htons
inet_addr
inet_ntoa
ntohs
recv
send
socket
shell32
ShellExecuteA
kernel32
ExitProcess
FindClose
FindFirstFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetFileTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetVersionExA
GetWindowsDirectoryA
CopyFileA
LoadLibraryA
CreateFileA
ReadFile
RtlUnwind
RtlZeroMemory
SetFileAttributesA
SetFileTime
Sleep
UnmapViewOfFile
CreateProcessA
WriteFile
lstrcatA
lstrcpyA
DeleteFileA
advapi32
OpenSCManagerA
OpenServiceA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegSetValueExA
StartServiceA
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
crtdll
__GetMainArgs
_stricmp
atoi
exit
fclose
fopen
fread
free
fseek
fwrite
malloc
memcpy
memset
raise
signal
sprintf
strcat
strchr
strcmp
strcpy
strlen
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 892B - Virtual size: 892B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE