Static task
static1
Behavioral task
behavioral1
Sample
2d980555e6ad30555c2ab85ac4e0db50_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2d980555e6ad30555c2ab85ac4e0db50_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
2d980555e6ad30555c2ab85ac4e0db50_JaffaCakes118
-
Size
181KB
-
MD5
2d980555e6ad30555c2ab85ac4e0db50
-
SHA1
e548a0fb5f4a393b86fd4a4019b1bbdc7a676b5d
-
SHA256
7c9ce348a53474ee1b5523844a15ff11fb00bda7be71267d51f682aeb8898995
-
SHA512
b912e0c01844ae5d11c4c6a82ab7daccbd7af1f84fc59ceaa51d8a3991d6263f5c069712958f4f97f559acffb7ecd43fe3eef3237f83f4adc2af5b4b5f34e2e8
-
SSDEEP
3072:coPyCwMaZcuaMSLh3nsAPUBMWFiAUq8zBHVNX:coPyCwkaSLh3nstBMWFF4n5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d980555e6ad30555c2ab85ac4e0db50_JaffaCakes118
Files
-
2d980555e6ad30555c2ab85ac4e0db50_JaffaCakes118.exe windows:4 windows x86 arch:x86
335ae45a4b1bc1aaf634d5d89b3e0c25
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
SetTimer
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
kernel32
WideCharToMultiByte
CreateThread
EnterCriticalSection
LeaveCriticalSection
GetLogicalDriveStringsA
Sleep
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
MultiByteToWideChar
GetUserDefaultLCID
GetOEMCP
CreateFileA
GetFileSize
ReadFile
CreateDirectoryA
GetCommandLineA
GetModuleHandleA
FreeLibrary
LoadLibraryA
LCMapStringA
CloseHandle
GetProcAddress
GetNativeSystemInfo
ReleaseMutex
CreateMutexA
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
advapi32
LookupAccountNameA
RegQueryValueExA
RegOpenKeyA
ConvertSidToStringSidW
IsValidSid
GetUserNameA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
ole32
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
ws2_32
getpeername
getsockname
accept
listen
bind
htons
ntohs
inet_addr
WSACleanup
recv
send
connect
socket
WSAStartup
inet_ntoa
closesocket
shlwapi
PathFileExistsA
dnsapi
DnsQuery_A
shell32
SHGetSpecialFolderPathA
msvcrt
_strnicmp
malloc
free
memmove
modf
__CxxFrameHandler
strrchr
strncpy
tolower
_ftol
atoi
_CIfmod
strncmp
strchr
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
oleaut32
RegisterTypeLi
LoadTypeLi
VarR8FromBool
VarR8FromCy
SysFreeString
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
VariantChangeType
SafeArrayCreate
SafeArrayDestroy
VariantClear
SysAllocString
LHashValOfNameSys
Sections
.text Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE