Static task
static1
Behavioral task
behavioral1
Sample
ba2bbf9c7809297a2ee1baba58c55e81_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
ba2bbf9c7809297a2ee1baba58c55e81_JaffaCakes118
-
Size
1.0MB
-
MD5
ba2bbf9c7809297a2ee1baba58c55e81
-
SHA1
b62317610a8d1f33cb566f40efbf0fd35954d5c8
-
SHA256
55819061820b24c4e0f6845d20e02d872993bc88821be47fd5d1543297266a07
-
SHA512
87dcf3494c094bcb2d527dd0d4fd170dd580f9ba36fbb7196deaab7629faf2c646aa69ad8278758d9d291528d468e2287f4f1ba1a86ec1d43f83bc17eb8fe54e
-
SSDEEP
12288:MUDNipGWJMHT/90G1m3AALuRuoBOE9g7MHEI:n/9Z1YLucmOmgAN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ba2bbf9c7809297a2ee1baba58c55e81_JaffaCakes118
Files
-
ba2bbf9c7809297a2ee1baba58c55e81_JaffaCakes118.exe windows:4 windows x86 arch:x86
0ffb67b11083f140aeef5cf0a3e83898
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
CloseHandle
WaitForSingleObject
GetVersionExA
CopyFileA
GetCurrentProcess
GetModuleHandleA
GlobalMemoryStatusEx
GetLastError
GetProcessHeap
VirtualProtect
HeapFree
SetEvent
CreateEventA
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetStartupInfoA
GetLocalTime
lstrlenA
CreateFileA
WriteFile
lstrcatA
GetTickCount
LocalAlloc
LocalSize
LocalFree
lstrcpyA
Sleep
InterlockedExchange
VirtualFree
VirtualAlloc
HeapAlloc
user32
wsprintfA
advapi32
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenSCManagerA
CreateServiceA
OpenServiceA
StartServiceA
RegOpenKeyA
RegSetValueExA
RegCloseKey
CloseServiceHandle
OpenEventLogA
ClearEventLogA
CloseEventLog
StartServiceCtrlDispatcherA
msvcrt
fclose
??3@YAXPAX@Z
memcpy
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
memset
??2@YAPAXI@Z
memcmp
strlen
strstr
strcpy
strncpy
strrchr
atoi
strcspn
rand
sprintf
realloc
free
_beginthreadex
_except_handler3
_strcmpi
fprintf
fopen
strchr
??1type_info@@UAE@XZ
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_stricmp
_strupr
Sections
.text Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 792KB - Virtual size: 792KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE