Static task
static1
Behavioral task
behavioral1
Sample
26f4cc3c95c00b556e7386913606cfd9_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
26f4cc3c95c00b556e7386913606cfd9_JaffaCakes118
-
Size
176KB
-
MD5
26f4cc3c95c00b556e7386913606cfd9
-
SHA1
9330a00293383c077ad94faaf3f2faf4c1f8158a
-
SHA256
6e2bcebf71808ca154b1363897c14856a0ff881772f5bb46734ea7ea3c5323c1
-
SHA512
aa69c0eca77864716288f2073f33f6a75e3e153f10337a994b353988f9f2636381bfbc04dc1705655980e22436b7b8d2e29a911989fa721580f9ac53ee49dc29
-
SSDEEP
3072:xrOjmc451zi/x/O9y6Yh7YhV2b0YKWNg7qW3DMsnsBdSADJfxUz:mm5liNOw942bFKWNG3T3s//DJZUz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26f4cc3c95c00b556e7386913606cfd9_JaffaCakes118
Files
-
26f4cc3c95c00b556e7386913606cfd9_JaffaCakes118.exe windows:4 windows x86 arch:x86
09453e0fe5e87b913d1eaedfd579e9df
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord823
ord825
msvcrt
_onexit
__dllonexit
_controlfp
__CxxFrameHandler
_CxxThrowException
wcslen
memmove
_ftol
malloc
_except_handler3
realloc
free
strstr
rand
exit
atoi
sprintf
strncmp
_beginthreadex
calloc
??1type_info@@UAE@XZ
_exit
_XcptFilter
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
kernel32
lstrcmpiA
Process32Next
LocalFree
WideCharToMultiByte
CopyFileA
GetStartupInfoA
CreateToolhelp32Snapshot
GetProcAddress
LoadLibraryA
CreateEventA
WaitForSingleObject
ResetEvent
SetEvent
InterlockedExchange
CancelIo
Sleep
CloseHandle
WriteFile
SetFilePointer
CreateFileA
GetFileSize
ReadFile
GetWindowsDirectoryA
VirtualAlloc
GetFileAttributesA
CreateProcessA
lstrlenA
lstrcpyA
TerminateThread
lstrcatA
GetTickCount
DeleteFileA
GetLastError
GetCurrentProcess
HeapAlloc
GetProcessHeap
GetModuleHandleA
GetDiskFreeSpaceExA
GetDriveTypeA
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExA
FindClose
FindFirstFileA
GetModuleFileNameA
InterlockedDecrement
MultiByteToWideChar
OpenEventA
CreateMutexA
ExitProcess
CreateThread
MoveFileExA
MoveFileA
GetCurrentThreadId
Process32First
user32
ShowWindow
GetInputState
FindWindowA
LoadCursorA
SendMessageA
PostThreadMessageA
GetWindow
GetMessageA
RegisterClassA
wsprintfA
SendInput
GetDlgCtrlID
LoadIconA
CloseDesktop
SetThreadDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenInputDesktop
OpenDesktopA
PostMessageA
FindWindowExA
gdi32
GetStockObject
advapi32
StartServiceCtrlDispatcherA
LookupPrivilegeValueA
CloseEventLog
ClearEventLogA
OpenEventLogA
OpenSCManagerA
CreateServiceA
LockServiceDatabase
ChangeServiceConfig2A
UnlockServiceDatabase
OpenServiceA
StartServiceA
CloseServiceHandle
RegOpenKeyExA
OpenProcessToken
RegCreateKeyExA
RegSetValueExA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyA
RegQueryValueExA
RegCloseKey
AdjustTokenPrivileges
shell32
ShellExecuteA
SHGetSpecialFolderPathA
ws2_32
select
recv
WSAStartup
setsockopt
connect
getsockname
gethostname
send
closesocket
socket
gethostbyname
htons
WSACleanup
iphlpapi
GetIfTable
ole32
OleRun
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
SysAllocString
GetErrorInfo
VariantClear
urlmon
URLDownloadToFileA
wininet
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
Sections
.text Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE