Static task
static1
Behavioral task
behavioral1
Sample
fb1a35262af27c67cfa9b36886fbe7c3_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fb1a35262af27c67cfa9b36886fbe7c3_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fb1a35262af27c67cfa9b36886fbe7c3_JaffaCakes118
-
Size
452KB
-
MD5
fb1a35262af27c67cfa9b36886fbe7c3
-
SHA1
46db5e722c57884580d201d007ddaf5a53c9862f
-
SHA256
740cc4f1db89190b001867bbdc99ed057d2160591911ed017bbd535222a3aef2
-
SHA512
498cacda662fffba6c4f669a3dd9cd9f13d9757cd888e43a95ed63305ba39a4fc3fc64e33d442cf5c7deccb62f6e7e0d6a1d784111ca74df6c097ef34e8aec54
-
SSDEEP
6144:j5s6LhYNAIXGtGc/jflgXI+k0cN0ueUABAI/+vWln/InOBe0vRHJCw9gKNcS:j5X4AIWtFblgXISUgAqgonwnOQyRHJ5H
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb1a35262af27c67cfa9b36886fbe7c3_JaffaCakes118
Files
-
fb1a35262af27c67cfa9b36886fbe7c3_JaffaCakes118.exe windows:4 windows x86 arch:x86
0af131e8b2149dae7b38d60aba808656
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
OutputDebugStringA
GetLastError
CreateMutexA
CloseHandle
GetCurrentProcess
DeleteFileA
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceA
GetModuleHandleA
OpenFile
WaitForSingleObject
CreateThread
FindClose
FindNextFileA
FindFirstFileA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetEndOfFile
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
GetComputerNameA
GetVolumeInformationA
GetModuleFileNameA
GetSystemDirectoryA
CreateProcessA
Sleep
GetLocalTime
lstrlenA
CreateFileA
FlushFileBuffers
SetStdHandle
SetFilePointer
RtlUnwind
GetFileType
GetStdHandle
SetEnvironmentVariableA
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetProcAddress
WideCharToMultiByte
HeapFree
HeapAlloc
HeapReAlloc
GetTimeZoneInformation
GetSystemTime
GetFileAttributesA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
WriteFile
ReadFile
user32
EnumChildWindows
GetWindowThreadProcessId
GetClassNameA
GetParent
CloseDesktop
SetForegroundWindow
EnumDesktopWindows
PostMessageA
CreateDesktopA
OpenDesktopA
SendMessageA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
shell32
SHGetSpecialFolderPathA
ws2_32
WSAGetLastError
WSAStartup
connect
setsockopt
socket
htons
recv
closesocket
shutdown
inet_addr
gethostbyname
WSACleanup
send
Sections
.text Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 368KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ