Static task
static1
Behavioral task
behavioral1
Sample
085c0a41ca33ad6ec11bf31e6c7980ef_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
085c0a41ca33ad6ec11bf31e6c7980ef_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
085c0a41ca33ad6ec11bf31e6c7980ef_JaffaCakes118
-
Size
52KB
-
MD5
085c0a41ca33ad6ec11bf31e6c7980ef
-
SHA1
e5b9fa02e0b8445443137f76615f7d0c408bd94d
-
SHA256
40f83476cc8033f959bb331a48c690cca6f2b5598b66cf4fc4c27b6fc1a78d1c
-
SHA512
753b3611a834c58277054c57c3472b34267ff8ce3c4a5bc7c84bd8e179fd1a40c564cb0e86410344dd7414fa3e180abaf9e999583eb84d1c7488dda210eebb99
-
SSDEEP
768:Gt6HPemKEaXZXeOrloDv00QObcbRnT6h1PY:GIHGEaXZXeooTQO2GM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 085c0a41ca33ad6ec11bf31e6c7980ef_JaffaCakes118
Files
-
085c0a41ca33ad6ec11bf31e6c7980ef_JaffaCakes118.exe windows:4 windows x86 arch:x86
8f20a9fc4baf8737315c2442d2c8dadf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetVolumeInformationA
CreateThread
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
ExitProcess
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
CreateDirectoryA
CreateFileA
WriteFile
CloseHandle
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStringTypeW
RtlUnwind
WinExec
HeapAlloc
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
HeapFree
VirtualAlloc
user32
CopyRect
IsChild
IsWindowVisible
SendMessageA
EnableWindow
SetWindowTextA
MessageBoxA
DialogBoxParamA
GetParent
GetDesktopWindow
GetWindowRect
GetDlgItem
OffsetRect
SetWindowPos
wsprintfA
advapi32
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
wsock32
sendto
connect
socket
WSAStartup
ioctlsocket
recvfrom
htons
comctl32
InitCommonControlsEx
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ