Behavioral task
behavioral1
Sample
001a09d3c1f8628684b162df83d154af_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
001a09d3c1f8628684b162df83d154af_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
001a09d3c1f8628684b162df83d154af_JaffaCakes118
-
Size
23KB
-
MD5
001a09d3c1f8628684b162df83d154af
-
SHA1
415040dfc1196080665d86345c4b61c2017240bd
-
SHA256
8cf6bab1228f345d7ea877547a4de3fe0dab1d81c7cfa18d6f1385013463f129
-
SHA512
f409c2d8f6cc83466dcc24211529f770cf24430adb42b53f56cdf52aa630937e562dd2c98626cc52eab07bd3f17b93f52ee01c7b456ea1e51e725421842814db
-
SSDEEP
384:PwswvxVtctcg1lNyxLlNfQoc7iCxtVFHhddnkQbuCfFQDRSB:Av7tc6g1etIp79XTfFd
Malware Config
Signatures
-
Detects Kaiten/Tsunami Payload 1 IoCs
resource yara_rule sample family_kaiten2 -
Detects Kaiten/Tsunami payload 1 IoCs
resource yara_rule sample family_kaiten -
Kaiten family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 001a09d3c1f8628684b162df83d154af_JaffaCakes118
Files
-
001a09d3c1f8628684b162df83d154af_JaffaCakes118.exe windows:4 windows x86 arch:x86
4921c1ec8a6876d2002a7bcba5a18caa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
cygwin1
__errno
__main
_fopen64
abort
accept
atoi
atol
bcopy
bind
calloc
close
connect
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fgets
fork
fputc
free
gethostbyname
getpid
getppid
htons
inet_addr
inet_network
ioctl
kill
listen
malloc
memcpy
memset
ntohl
pclose
popen
pthread_atfork
rand
realloc
recv
select
sendto
setsockopt
sleep
socket
sprintf
srand
strcasecmp
strcat
strcpy
strdup
strlen
strncmp
strncpy
strtok
time
toupper
vsprintf
waitpid
write
kernel32
AddAtomA
FindAtomA
GetAtomNameA
GetModuleHandleA
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE