Static task
static1
Behavioral task
behavioral1
Sample
1ca7a86d670b20eff76f23edb47d95a4_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1ca7a86d670b20eff76f23edb47d95a4_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
1ca7a86d670b20eff76f23edb47d95a4_JaffaCakes118
-
Size
338KB
-
MD5
1ca7a86d670b20eff76f23edb47d95a4
-
SHA1
0a1cafcc14ef969d4766843c8e0d6b9b12745f9c
-
SHA256
dfa9b0480ef434ec912d51ae47f0d6abd8647fd072c24989e3f3b293bc3af2f2
-
SHA512
32821a63c0e2d82332daff2a347f4970d6cbcc5afe530c19faf38e40691718e7e5d7c3d85615462f111268c35d7d3f415e8e7ab3e58e37558a73ccac60ece65c
-
SSDEEP
6144:BkxgrJ+ZdARvSJ4AwFoJOWavgRJR1aRXbVf42pjZSkwMVAJ07UHJGZUdK0mQ28fw:TJ+ZdswkvvYRkRJZp8fOAW7UHOU00D9o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1ca7a86d670b20eff76f23edb47d95a4_JaffaCakes118
Files
-
1ca7a86d670b20eff76f23edb47d95a4_JaffaCakes118.exe windows:4 windows x86 arch:x86
3053f09338462007d940d61c4bb66547
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetCurrentThread
DuplicateHandle
GetModuleHandleA
WaitForSingleObject
FindFirstFileA
SetUnhandledExceptionFilter
GetSystemDirectoryA
QueryPerformanceFrequency
GlobalAlloc
GlobalHandle
LoadLibraryA
GetCurrentThreadId
CreateSemaphoreA
SetThreadAffinityMask
VirtualQuery
lstrcpyA
InitializeCriticalSection
TlsFree
EnterCriticalSection
GetThreadPriority
Sleep
CreateEventA
SetThreadPriority
SetLastError
GetModuleHandleExA
ResumeThread
CloseHandle
GetThreadContext
FindNextFileA
VirtualProtect
ReleaseSemaphore
OpenProcess
SetEvent
ExitProcess
SetProcessAffinityMask
TlsGetValue
GetVersion
GetTempPathA
ResetEvent
IsDBCSLeadByteEx
lstrcpynA
GlobalMemoryStatus
SetThreadContext
TlsAlloc
GetProcAddress
QueryPerformanceCounter
WaitForMultipleObjects
GetTickCount
GetCurrentProcess
LeaveCriticalSection
GetLastError
TlsSetValue
GetTimeZoneInformation
GetProcessAffinityMask
SuspendThread
GetStdHandle
DeleteCriticalSection
crypt32
CertEnumCertificatesInStore
CertOpenSystemStoreA
CertCloseStore
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegisterEventSourceA
ReportEventA
ws2_32
closesocket
sendto
ioctlsocket
freeaddrinfo
WSACleanup
getsockopt
connect
bind
getsockname
WSAStartup
__WSAFDIsSet
WSASetLastError
select
recv
getnameinfo
ntohs
ntohl
WSAGetLastError
htonl
listen
inet_addr
WSAEnumNetworkEvents
send
gethostname
recvfrom
htons
socket
setsockopt
getaddrinfo
shutdown
gethostbyname
getpeername
accept
msvcrt
_open
_wfindfirst
_unlink
memcmp
_ftime
_initterm
fputs
strncat
__setusermatherr
abort
strrchr
_getpid
qsort
memchr
_iob
strncmp
strcat
_fstati64
ferror
_setjmp3
strcpy
feof
gmtime
rand
_get_osfhandle
setlocale
fsetpos
_amsg_exit
_read
time
setvbuf
longjmp
fputc
_exit
rename
isspace
_stati64
getc
free
_errno
_ftime64
_beginthreadex
strcspn
_mkdir
calloc
toupper
putc
tolower
printf
_stat
atof
fwprintf
wcsstr
strchr
_wfopen
malloc
_unlock
bsearch
_findclose
strlen
atoi
signal
fopen
vfprintf
strtol
strtoul
_fdopen
fflush
log10
fgetc
wcslen
ungetc
puts
_setmode
fgetpos
isxdigit
_fileno
_getch
fread
isprint
_filelengthi64
mktime
__pioinfo
realloc
_onexit
_snwprintf
_strnicmp
fprintf
strerror
isalnum
_putenv
localtime
exit
fclose
localeconv
_vsnprintf
_strdup
_close
raise
isalpha
fwrite
strncpy
fseek
islower
sscanf
__dllonexit
_wfindnext
_rmdir
strftime
memset
memcpy
putchar
wcscpy
_lseeki64
__doserrno
_write
isupper
__mb_cur_max
strcmp
_lock
sprintf
_endthreadex
_access
strspn
_stricmp
getenv
srand
memmove
fgets
ftell
strstr
gdi32
CreateDCA
GetBitmapBits
CreateCompatibleDC
BitBlt
SelectObject
CreateCompatibleBitmap
DeleteDC
GetObjectA
GetDeviceCaps
DeleteObject
user32
GetProcessWindowStation
GetDesktopWindow
MessageBoxW
wsprintfA
MessageBoxA
GetUserObjectInformationW
winmm
timeGetTime
Sections
.text Size: 73KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 209KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 16KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE