Static task
static1
Behavioral task
behavioral1
Sample
b80aa583591eaf758fd95ab4ea7afe39_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b80aa583591eaf758fd95ab4ea7afe39_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
b80aa583591eaf758fd95ab4ea7afe39_JaffaCakes118
-
Size
304KB
-
MD5
b80aa583591eaf758fd95ab4ea7afe39
-
SHA1
f9a090dbbf2985d8a082fea6da490e8a952fce9b
-
SHA256
0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5
-
SHA512
d235cfc38f1524133bdd2dfab495d2590d63b1b17229c846ba6a5cc3013a9260602b8ccc057478e90b8e2b3dab30c002b8e0142da88c6e40987cfbfe3ee5934b
-
SSDEEP
6144:s6EQd7Yl0ooomZYloYl9SaG6GnxaKloTvKpDWWUMm:vd7Y+ZomClodaG6GxaK2Uo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b80aa583591eaf758fd95ab4ea7afe39_JaffaCakes118
Files
-
b80aa583591eaf758fd95ab4ea7afe39_JaffaCakes118.exe windows:4 windows x86 arch:x86
a07dc157e35ca028206540c134375a26
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileW
GetDiskFreeSpaceExW
GetCurrentProcess
GetProcAddress
MoveFileW
GetFileAttributesW
LocalAlloc
CreateFileA
GetModuleFileNameA
SetFilePointerEx
SetFilePointer
GetDriveTypeW
GetLogicalDrives
GetWindowsDirectoryW
SetFileAttributesW
GetComputerNameA
GetModuleFileNameW
LoadLibraryW
GetLastError
CopyFileW
FindNextFileW
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
FindClose
GetTickCount
GetCurrentThreadId
GetFileSize
ReadFile
DeleteFileW
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
GlobalUnlock
GetTempPathW
CreateFileW
WriteFile
CreateProcessW
Sleep
CreateThread
WaitForSingleObject
CloseHandle
SetUnhandledExceptionFilter
MultiByteToWideChar
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
ExitProcess
TerminateProcess
RtlUnwind
InterlockedDecrement
InterlockedIncrement
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
user32
SystemParametersInfoW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
LoadStringW
RegisterClassExW
LoadCursorW
UpdateWindow
ShowWindow
CreateWindowExW
PostQuitMessage
EndPaint
DrawTextW
GetClientRect
EndDialog
DefWindowProcW
DestroyWindow
DialogBoxParamW
BeginPaint
advapi32
ChangeServiceConfig2W
StartServiceW
RegisterServiceCtrlHandlerW
SetServiceStatus
LookupPrivilegeValueW
DuplicateTokenEx
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserW
OpenSCManagerW
ControlService
DeleteService
OpenSCManagerA
OpenServiceW
CreateServiceW
CloseServiceHandle
QueryServiceStatus
StartServiceA
StartServiceCtrlDispatcherW
shell32
SHGetSpecialFolderPathW
ws2_32
inet_addr
closesocket
setsockopt
select
connect
ioctlsocket
WSAGetLastError
socket
shutdown
send
htons
gethostbyname
WSAStartup
shlwapi
PathFindExtensionW
StrStrIA
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
netapi32
NetShareEnum
NetApiBufferFree
Sections
.text Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 232KB - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ