Static task
static1
Behavioral task
behavioral1
Sample
2e8646f985bb61d26f41bc563c8f8948_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2e8646f985bb61d26f41bc563c8f8948_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2e8646f985bb61d26f41bc563c8f8948_JaffaCakes118
-
Size
32KB
-
MD5
2e8646f985bb61d26f41bc563c8f8948
-
SHA1
1a9552cc9f2f9bdf3f6c9b5796efdc0ae57cc412
-
SHA256
c7df90b46e56b59bb8639fb586380feaf3806c16bb1e3eca10c8cb53a6a89949
-
SHA512
32094024bbc66df6f2b8202db3999975fcb4a321ef8205c7c724e166ebb1c997943165ac4d429e915179e1355d68d2ea8f0ea9aa4525db856bc81135012ea902
-
SSDEEP
384:1/q/WUz8fxcL2Q81EcSl5i1RQrCprajATJcqc/RK97m:BGjjLoEcSni1RQmojAWqco9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e8646f985bb61d26f41bc563c8f8948_JaffaCakes118
Files
-
2e8646f985bb61d26f41bc563c8f8948_JaffaCakes118.exe windows:4 windows x86 arch:x86
281e3c7fd71345e9ed7e3a2a5a5427c0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessA
GetModuleFileNameA
GetSystemDirectoryA
DeleteFileA
GetWindowsDirectoryA
Process32Next
OpenProcess
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
ResumeThread
SetThreadPriority
CloseHandle
SetPriorityClass
GetCurrentProcess
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
CreateThread
ExitProcess
CopyFileA
GetStartupInfoA
GetModuleHandleA
GetSystemTime
Sleep
LoadLibraryA
GetCurrentThread
GetProcAddress
user32
GetWindowTextA
EnumWindows
advapi32
RegSetValueExA
RegCloseKey
RegOpenKeyA
RegQueryValueExA
msvcrt
??3@YAXPAX@Z
fclose
fwrite
fopen
sprintf
rand
srand
time
fread
fseek
strstr
??2@YAPAXI@Z
_except_handler3
fputs
fgets
exit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_stricmp
wininet
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
winmm
timeGetTime
netapi32
Netbios
psapi
GetModuleFileNameExA
ws2_32
htons
socket
WSAStartup
connect
gethostbyname
inet_addr
send
Sections
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
.data
-
.rdata
-
.rsrc/GROUP_ICON/110
-
.rsrc/ICON/1.ico
-
.rsrc/MANIFEST/1.xml
-
.rsrc/version.txt
-
.text