Static task
static1
Behavioral task
behavioral1
Sample
b2e0b55d3e1597f711ee1b0c3f54261d_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b2e0b55d3e1597f711ee1b0c3f54261d_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
b2e0b55d3e1597f711ee1b0c3f54261d_JaffaCakes118
-
Size
183KB
-
MD5
b2e0b55d3e1597f711ee1b0c3f54261d
-
SHA1
c238e784ca7c7df28983084ba211025846b4f628
-
SHA256
7e4fb5e2fb2ed9412e0dac6d29d1788551fd7cb2eb056da5478094f80b399222
-
SHA512
f45fd4d694029473bae8736b8e499dc705536c9a4e80980f6886bd9b4917a4a361ed9407d344a826270a9c3354143b76ea054afaf9cf55f9bb04ff1825764e1e
-
SSDEEP
1536:QKp3Gm4qo8m7V2PB+tw0JwM+51V0JbClqp+f2C35OIRo2oEoK0KLJ+YoRhdPgBD3:QWrypwM+5D4+Yw2C3QrNPgBCDFVphXE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b2e0b55d3e1597f711ee1b0c3f54261d_JaffaCakes118
Files
-
b2e0b55d3e1597f711ee1b0c3f54261d_JaffaCakes118.exe windows:4 windows x86 arch:x86
335ae45a4b1bc1aaf634d5d89b3e0c25
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
SetTimer
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
kernel32
WideCharToMultiByte
CreateThread
EnterCriticalSection
LeaveCriticalSection
GetLogicalDriveStringsA
Sleep
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
MultiByteToWideChar
GetUserDefaultLCID
GetOEMCP
CreateFileA
GetFileSize
ReadFile
CreateDirectoryA
GetCommandLineA
GetModuleHandleA
FreeLibrary
LoadLibraryA
LCMapStringA
CloseHandle
GetProcAddress
GetNativeSystemInfo
ReleaseMutex
CreateMutexA
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
advapi32
LookupAccountNameA
RegQueryValueExA
RegOpenKeyA
ConvertSidToStringSidW
IsValidSid
GetUserNameA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
ole32
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
ws2_32
getpeername
getsockname
accept
listen
bind
htons
ntohs
inet_addr
WSACleanup
recv
send
connect
socket
WSAStartup
inet_ntoa
closesocket
shlwapi
PathFileExistsA
dnsapi
DnsQuery_A
shell32
SHGetSpecialFolderPathA
msvcrt
_strnicmp
malloc
free
memmove
modf
__CxxFrameHandler
strrchr
strncpy
tolower
_ftol
atoi
_CIfmod
strncmp
strchr
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
oleaut32
RegisterTypeLi
LoadTypeLi
VarR8FromBool
VarR8FromCy
SysFreeString
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
VariantChangeType
SafeArrayCreate
SafeArrayDestroy
VariantClear
SysAllocString
LHashValOfNameSys
Sections
.te1w Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE