Static task
static1
Behavioral task
behavioral1
Sample
f244e4f710dc1f849559a153c98dc6ba_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f244e4f710dc1f849559a153c98dc6ba_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f244e4f710dc1f849559a153c98dc6ba_JaffaCakes118
-
Size
30KB
-
MD5
f244e4f710dc1f849559a153c98dc6ba
-
SHA1
1fae9f541698b17f69b4fd23b4edbb52c8b110fd
-
SHA256
1c99987629af46aef68b81df7cc52b906b26a638881c419856422d035149db39
-
SHA512
4527ee7419836f954027440323e61652f8e87e45ec0700d53696ebe6c86a98d63492cc9b7de6390045c1c90a023be3452a1f7ad6ed94fd4a78911f77065384a2
-
SSDEEP
384:sVyYj//UBrTOLhfxiA7Eh4ASejHdckCJiTXAU+CUAOJ3UcdFUeJ7/s3ON:fYbUB+Lhf1EaASDsrGUOSUFUyzs3O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f244e4f710dc1f849559a153c98dc6ba_JaffaCakes118
Files
-
f244e4f710dc1f849559a153c98dc6ba_JaffaCakes118.exe windows:4 windows x86 arch:x86
ceb5d4f2c6057321473b66c4c9c8ae97
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CreateStreamOnHGlobal
CoTaskMemFree
kernel32
lstrlenA
lstrlenW
CloseHandle
CompareStringA
CopyFileA
CreateDirectoryA
lstrcpynA
lstrcpyA
lstrcmpiA
lstrcmpA
lstrcatA
WriteFile
WideCharToMultiByte
UnmapViewOfFile
Sleep
SetFilePointer
CreateFileA
CreateFileMappingA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
RtlMoveMemory
RemoveDirectoryA
ReadFile
Process32Next
Process32First
OpenProcess
MultiByteToWideChar
MoveFileA
MapViewOfFile
LocalFree
LoadLibraryA
GlobalMemoryStatus
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetTempPathA
GetSystemDirectoryA
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetModuleFileNameA
GetLogicalDrives
GetLocaleInfoA
GetLocalTime
GetFileSize
GetFileAttributesA
GetDriveTypeA
GetDiskFreeSpaceA
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryA
GetComputerNameA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ExitProcess
user32
ReleaseDC
wsprintfA
GetDC
advapi32
RegCreateKeyA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumValueA
RegEnumKeyExA
GetUserNameA
shlwapi
StrRChrA
StrStrIA
StrCmpNA
StrChrA
shell32
ShellExecuteA
wsock32
socket
send
recv
listen
htons
getsockname
gethostname
connect
closesocket
accept
WSAStartup
bind
rasapi32
RasGetEntryPropertiesA
RasEnumEntriesA
RasGetEntryDialParamsA
gdi32
GetDeviceCaps
Sections
Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE