Static task
static1
Behavioral task
behavioral1
Sample
07aafb4e92d20fd01cd8d3f6fdc8f598_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
07aafb4e92d20fd01cd8d3f6fdc8f598_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
07aafb4e92d20fd01cd8d3f6fdc8f598_JaffaCakes118
-
Size
175KB
-
MD5
07aafb4e92d20fd01cd8d3f6fdc8f598
-
SHA1
4bba08e4888c5e2b4b2e1ceb45958e32882aee4c
-
SHA256
7b5ffb2905e61e80d6fa1893547e020cedce4e07df44ffcb613e8a9d84623c07
-
SHA512
93b17efae4a3460a7e0be6c0fadd34fdf61ee6088828a983ee85558f459d2a4cd1ba50f9969de6eb6d4e83897df4db57bec7624d0881a7af945deede1ebc3d88
-
SSDEEP
3072:/qYXNOlonC99U36+QpEIz1TJi+e9W5jXku5:C8Bnq9C6+QTz1Fe9WJ0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 07aafb4e92d20fd01cd8d3f6fdc8f598_JaffaCakes118
Files
-
07aafb4e92d20fd01cd8d3f6fdc8f598_JaffaCakes118.exe windows:5 windows x86 arch:x86
3a3fabef4a195e52669aacc791924d1b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
CloseHandle
CreateProcessA
DuplicateHandle
GetCurrentProcess
ExitThread
Sleep
ReadFile
PeekNamedPipe
WriteFile
CreatePipe
DisconnectNamedPipe
TerminateProcess
WaitForMultipleObjects
TerminateThread
CreateThread
GetStdHandle
FreeConsole
SetEndOfFile
GetNumberOfConsoleInputEvents
PeekConsoleInputA
SetConsoleMode
ReadConsoleInputA
GetTimeZoneInformation
CreateFileA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
GetLocaleInfoW
HeapSize
SetFilePointer
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
MultiByteToWideChar
CompareStringA
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
ExitProcess
Beep
RtlUnwind
InterlockedExchange
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
DeleteCriticalSection
FatalAppExitA
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
GetModuleFileNameA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetProcessHeap
wsock32
__WSAFDIsSet
select
listen
getsockname
recvfrom
accept
WSASetLastError
socket
setsockopt
bind
connect
htons
getservbyport
ntohs
getservbyname
ioctlsocket
gethostbyname
inet_addr
gethostbyaddr
WSAGetLastError
WSAStartup
WSACleanup
shutdown
closesocket
recv
send
Sections
.text Size: 143KB - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE