Behavioral task
behavioral1
Sample
2802969ee441c0ee786373f0ddb79e03_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2802969ee441c0ee786373f0ddb79e03_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
2802969ee441c0ee786373f0ddb79e03_JaffaCakes118
-
Size
967KB
-
MD5
2802969ee441c0ee786373f0ddb79e03
-
SHA1
58309f67f4850e3fcf6e43deddbc912ccf32cef1
-
SHA256
cce049752959850f4209684e82f04fc0b9492da285bc89293e7ce0f069b1bdd0
-
SHA512
49f34033d78fab23d826c62e4abf1dcd03247416628e4bec697da094aef338dc524873c125a2572521052566a6869217c718722e3a9de6c0246b4237f8e116c5
-
SSDEEP
24576:mUBL9twfrDZhHVWIokDkQYpkfRbPFuN3D0bD8skcM7DLVmd2RMxM2ohdxf33WrH8:mUlwrDZhHVWIokDkQYpkfRbPFuN3D0bJ
Malware Config
Signatures
Files
-
2802969ee441c0ee786373f0ddb79e03_JaffaCakes118.exe windows:6 windows x64 arch:x64
f7719741ffac52d7e6432ec749ee0b53
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
gethostname
connect
WSACleanup
__WSAFDIsSet
accept
send
ntohs
recv
WSAPoll
WSASetLastError
WSAStartup
select
WSARecvFrom
htonl
bind
WSAIoctl
WSASend
shutdown
listen
WSASocketW
getsockname
socket
WSARecv
ioctlsocket
FreeAddrInfoW
GetAddrInfoW
closesocket
getsockopt
setsockopt
WSAGetLastError
htons
iphlpapi
GetAdaptersAddresses
kernel32
GetFileSizeEx
HeapReAlloc
HeapAlloc
HeapFree
ExitProcess
ExitThread
SetFileAttributesW
GetFileAttributesExW
GetConsoleCP
SetStdHandle
GetCommandLineW
CompareStringW
GetModuleHandleExW
GetCommandLineA
RtlPcToFileHeader
GetStdHandle
SetConsoleMode
GetConsoleMode
CloseHandle
FreeConsole
GetConsoleWindow
SetThreadAffinityMask
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
GetProcAddress
GetModuleHandleW
VirtualProtect
VirtualFree
VirtualAlloc
LocalAlloc
GetLastError
LocalFree
FlushInstructionCache
SetConsoleCtrlHandler
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
PostQueuedCompletionStatus
Sleep
SetErrorMode
GetQueuedCompletionStatus
GetQueuedCompletionStatusEx
CreateIoCompletionPort
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
CreateFileW
DuplicateHandle
QueueUserWorkItem
MultiByteToWideChar
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
WideCharToMultiByte
SetConsoleCursorPosition
CreateDirectoryW
ReadFile
SetLastError
WriteFile
DeviceIoControl
RemoveDirectoryW
GetFinalPathNameByHandleW
SetFileTime
ReOpenFile
CreateHardLinkW
GetFileAttributesW
GetFileInformationByHandle
MoveFileExW
CopyFileW
CreateSymbolicLinkW
FlushFileBuffers
GetLongPathNameW
GetShortPathNameW
GetCurrentDirectoryW
ReadDirectoryChangesW
GetFileType
SleepConditionVariableCS
TlsSetValue
ReleaseSemaphore
WakeConditionVariable
InitializeConditionVariable
WaitForSingleObject
ResumeThread
SetEvent
TlsAlloc
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
CreateSemaphoreA
CreateEventA
CancelIo
SetHandleInformation
SetFileCompletionNotificationModes
VerifyVersionInfoA
GetModuleFileNameW
SetEnvironmentVariableW
GetSystemInfo
VerSetConditionMask
GetCurrentProcessId
QueryPerformanceCounter
FormatMessageA
DebugBreak
SetNamedPipeHandleState
CreateNamedPipeW
PeekNamedPipe
CancelSynchronousIo
GetNamedPipeHandleStateA
CancelIoEx
SwitchToThread
ConnectNamedPipe
GetModuleHandleA
LoadLibraryA
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
GetTickCount64
RaiseException
RtlUnwindEx
GetTimeZoneInformation
HeapSize
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
QueryPerformanceFrequency
CreateEventW
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
CreateThread
EncodePointer
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
user32
TranslateMessage
ShowWindow
DispatchMessageA
MapVirtualKeyW
GetMessageA
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
Sections
.text Size: 758KB - Virtual size: 757KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 33KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ