Static task
static1
Behavioral task
behavioral1
Sample
f6fb9c27e5185fb55db48e4e80cb343a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f6fb9c27e5185fb55db48e4e80cb343a_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f6fb9c27e5185fb55db48e4e80cb343a_JaffaCakes118
-
Size
50KB
-
MD5
f6fb9c27e5185fb55db48e4e80cb343a
-
SHA1
149c1f7a4902141562dbd6f374b53d527be72af6
-
SHA256
54c377cb790b0f648cc5085f77e90be85295d50c1545b32813e3f820a86b71c2
-
SHA512
93eb9c390a7787ca2e752eb665da181172f5632281cab6a2e7f4465aa4e7a3b6b288bffe881268466aa8301833b25a460395d40eee0d4ca293e6c11feb47f940
-
SSDEEP
768:etf9cmxzmIeu+Bjs3ax4DsE/FmpI6VtITnhfO8lkChFK6yVx2HAR9t7sig5:etfmMzmIefBjs3KDkm4hmOkChKmAGi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f6fb9c27e5185fb55db48e4e80cb343a_JaffaCakes118
Files
-
f6fb9c27e5185fb55db48e4e80cb343a_JaffaCakes118.exe windows:1 windows x86 arch:x86
5898d8b74a596cff3f24b0fca836a5fa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetFolderPathA
ShellExecuteEx
ws2_32
htons
gethostname
gethostbyname
connect
closesocket
WSAStartup
WSACleanup
send
socket
WSAIoctl
advapi32
RegEnumKeyExA
StartServiceA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
OpenSCManagerA
OpenProcessToken
LookupPrivilegeValueA
GetUserNameA
DeleteService
CreateServiceA
CloseServiceHandle
AdjustTokenPrivileges
crypt32
CryptUnprotectData
gdi32
GetDeviceCaps
kernel32
Sleep
SetProcessPriorityBoost
WideCharToMultiByte
UnmapViewOfFile
lstrlenW
CloseHandle
lstrlen
lstrcpyn
lstrcpy
lstrcmpi
lstrcmp
lstrcat
SetPriorityClass
SetErrorMode
OpenProcess
MultiByteToWideChar
MapViewOfFile
LocalFree
LocalAlloc
LoadLibraryA
GlobalMemoryStatus
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetTickCount
GetTempPathA
GetSystemDirectoryA
GetShortPathNameA
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetModuleFileNameA
GetLogicalDrives
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceA
GetCurrentProcess
GetCurrentDirectoryA
GetComputerNameA
FindNextFileA
FindFirstFileA
FindClose
ExpandEnvironmentStringsA
ExitProcess
DeleteFileA
CreateThread
CreateFileMappingA
CreateFileA
CopyFileA
WriteFile
ole32
CreateStreamOnHGlobal
CoTaskMemFree
psapi
GetModuleFileNameExA
EnumProcesses
EnumProcessModules
rasapi32
RasGetEntryPropertiesA
RasGetEntryDialParamsA
RasEnumEntriesA
shlwapi
StrChrA
PathFileExistsA
StrStrIA
StrRChrA
StrCmpNA
user32
GetDlgCtrlID
ReleaseDC
GetDC
FindWindowExA
SetActiveWindow
wsprintfA
FindWindowA
SendMessageA
wininet
InternetGetConnectedState
Sections
.text Size: 32KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
FCryptor Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ