Static task
static1
Behavioral task
behavioral1
Sample
712c90b8034adfa2ea1dfb69a6e24795_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
712c90b8034adfa2ea1dfb69a6e24795_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
712c90b8034adfa2ea1dfb69a6e24795_JaffaCakes118
-
Size
21KB
-
MD5
712c90b8034adfa2ea1dfb69a6e24795
-
SHA1
21cf3ed74f9b365fd750110ac05f788117f7f0a9
-
SHA256
379cd8722ec0be25840d9f96e7d976776f8c05050b4b608a4cd49bffe1fa99dc
-
SHA512
c8c5c84876b6b2b101f41cc1f1740e7bced89ab6ed19608a923f8bd7b9b7ad2a535ac0f9e7a7a7cb37f742ef75a158c465d4066f70bca4719e0c539c5ad4aaf5
-
SSDEEP
384:bLSBESxmmITmZg14QUo15KAZO2UB366DSAdg36Sp5O25Fxn75Zm7:3fSxmjhP5RZO2c366DSp335F5FFe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 712c90b8034adfa2ea1dfb69a6e24795_JaffaCakes118
Files
-
712c90b8034adfa2ea1dfb69a6e24795_JaffaCakes118.exe windows:5 windows x86 arch:x86
653737339c3c6af2cc985a2434e080d1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetOpenA
HttpSendRequestA
HttpQueryInfoA
InternetCrackUrlA
HttpOpenRequestA
InternetSetOptionA
InternetQueryOptionA
InternetReadFile
InternetConnectA
InternetCloseHandle
iphlpapi
GetAdaptersAddresses
psapi
GetProcessImageFileNameA
EnumProcesses
ntdll
RtlDecompressBuffer
kernel32
GetComputerNameA
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
GetVersion
lstrcpyA
lstrcatA
lstrlenA
GetWindowsDirectoryA
GetVolumeInformationA
VirtualQuery
Sleep
GetProcAddress
VirtualAlloc
VirtualFree
VirtualAllocEx
VirtualFreeEx
OpenProcess
TerminateProcess
CreateThread
GetProcessId
GetLastError
WriteProcessMemory
GetThreadContext
SetThreadContext
ResumeThread
WriteFile
CloseHandle
GetSystemInfo
lstrcmpiA
LoadLibraryA
GetModuleHandleA
CreateProcessA
GetEnvironmentVariableA
GetTempPathA
GetTempFileNameA
user32
wsprintfA
advapi32
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptDecrypt
CryptDestroyKey
CryptDeriveKey
CryptReleaseContext
CryptAcquireContextA
LookupAccountSidA
GetTokenInformation
OpenProcessToken
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.edata Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE