Static task
static1
Behavioral task
behavioral1
Sample
f605b8d6df4abcd922b6f5af22e8eb8c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f605b8d6df4abcd922b6f5af22e8eb8c_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f605b8d6df4abcd922b6f5af22e8eb8c_JaffaCakes118
-
Size
3KB
-
MD5
f605b8d6df4abcd922b6f5af22e8eb8c
-
SHA1
faeb6fc5d6e5d34a9acda002f8b12cbd0b31e98d
-
SHA256
a81a315b0d67f2f2986d1739c9de3604d45a76a09a426c9c47a67f181422ff00
-
SHA512
eff7968f9412cbfe253798ba6ae1fd0eca5a8bef886b760d869eb61542cdb48072afe73c27c8d5df24fe1561568369553121ec901ad0a6f7c111881580eeb46e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f605b8d6df4abcd922b6f5af22e8eb8c_JaffaCakes118
Files
-
f605b8d6df4abcd922b6f5af22e8eb8c_JaffaCakes118.exe windows:1 windows x86 arch:x86
c25ec321ca540bed11e701db67551ed6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
LdrLoadDll
ZwAllocateVirtualMemory
ZwWriteVirtualMemory
ZwProtectVirtualMemory
LdrGetDllHandle
kernel32
CloseHandle
CopyFileA
CreateProcessA
ExitProcess
GetCommandLineA
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
IsBadReadPtr
ResumeThread
WideCharToMultiByte
lstrlenA
advapi32
RegCloseKey
RegCreateKeyA
RegOpenKeyExA
RegSetValueExA
user32
wsprintfA
ws2_32
connect
send
socket
gethostbyname
WSAStartup
Sections
Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE