Static task
static1
Behavioral task
behavioral1
Sample
6675674d9aa8cbb449482e8c9a71f054_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6675674d9aa8cbb449482e8c9a71f054_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
6675674d9aa8cbb449482e8c9a71f054_JaffaCakes118
-
Size
1.1MB
-
MD5
6675674d9aa8cbb449482e8c9a71f054
-
SHA1
8d1741518030f9a353746aa9931bc2dd30eae2f9
-
SHA256
d05bff8514175288a47e64176aedaef407d0366a28740ff373f7a92aa69edd5f
-
SHA512
bd9da93f9da49dc4146e8e840dad3984e1eac69e00be16e301b4b763e940fccde76e15585d446c4486e49bff4b09f71dd86edb64b178965a0c7ea163535e4283
-
SSDEEP
12288:ZOtQm3ZcNPEFDBgTxhy9T+RNGMMzalrnTfj+Ha//zGlq1fw4CiVPPdvNmOxnPDQ+:Eoygdg9T+RNGahfiH8KWflnmEPN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6675674d9aa8cbb449482e8c9a71f054_JaffaCakes118
Files
-
6675674d9aa8cbb449482e8c9a71f054_JaffaCakes118.exe windows:4 windows x86 arch:x86
34798b462a941b53c14908c6e4e5633e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
inet_addr
gethostbyname
getpeername
shutdown
closesocket
setsockopt
send
recv
inet_ntoa
socket
WSAGetLastError
ioctlsocket
htons
connect
WSAStartup
WSACleanup
getservbyname
ntohs
kernel32
GetFullPathNameA
GetCurrentDirectoryA
SetEndOfFile
GetLocaleInfoW
LCMapStringW
LCMapStringA
LoadLibraryA
SetStdHandle
GetOEMCP
GetACP
CompareStringW
CompareStringA
SetFilePointer
GetStringTypeW
GetStringTypeA
Sleep
LeaveCriticalSection
EnterCriticalSection
GetWindowsDirectoryA
CloseHandle
SetNamedPipeHandleState
WaitNamedPipeA
GetDriveTypeA
GetLastError
UnmapViewOfFile
WaitForSingleObject
SetEvent
MapViewOfFile
OpenFileMappingA
OpenEventA
InterlockedIncrement
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
TlsFree
TlsSetValue
TlsGetValue
ReadFile
WriteFile
WaitForMultipleObjects
GetFileAttributesExA
SetThreadPriority
CreateSemaphoreA
InterlockedDecrement
ReleaseSemaphore
SetCurrentDirectoryA
GetFileInformationByHandle
CreateFileA
WideCharToMultiByte
SetConsoleCtrlHandler
ExitProcess
TerminateProcess
GetCurrentProcess
ReadConsoleA
SetConsoleMode
GetConsoleMode
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
HeapAlloc
HeapFree
PeekNamedPipe
MultiByteToWideChar
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
WriteConsoleA
HeapReAlloc
FindFirstFileA
FindNextFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ResumeThread
CreateThread
ExitThread
HeapSize
FatalAppExitA
UnhandledExceptionFilter
GetCurrentThreadId
SetLastError
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FlushFileBuffers
GetProcAddress
GetModuleHandleA
RaiseException
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
VirtualAlloc
IsBadWritePtr
SetEnvironmentVariableW
SetEnvironmentVariableA
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
advapi32
RegEnumValueA
RegCloseKey
RegOpenKeyExA
Sections
.text Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 904KB - Virtual size: 917KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE