Static task
static1
Behavioral task
behavioral1
Sample
0867fb3f964b7b6562c6b6426e5a6875_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0867fb3f964b7b6562c6b6426e5a6875_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0867fb3f964b7b6562c6b6426e5a6875_JaffaCakes118
-
Size
197KB
-
MD5
0867fb3f964b7b6562c6b6426e5a6875
-
SHA1
c0df6a4997a72134dfaf9f9c5dddf4b85081889c
-
SHA256
f5c20103421eede28403041e64901e7ced90490572676887b623c166e528183d
-
SHA512
1e3d3b5c6e18f6980979a794bfc4eed96ff72e94eae35ef72169e892bf134441163f9da642cb6d4666310d928eead23ae3f9cc9cddfa0bef90aff807f15cb878
-
SSDEEP
3072:S4Grt1OnsS8QBnLUheEVO5AWKWvKDMww+rvIJvZoXhm+2ea57oDei5L:/GrtgnssLYoANWvK4ww6IwtUuz5L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0867fb3f964b7b6562c6b6426e5a6875_JaffaCakes118
Files
-
0867fb3f964b7b6562c6b6426e5a6875_JaffaCakes118.exe windows:5 windows x86 arch:x86
686b0672ff5b75b2aafa82bf98aac997
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
inet_ntoa
gethostbyaddr
getsockname
setsockopt
ioctlsocket
bind
listen
select
__WSAFDIsSet
accept
WSACleanup
WSAStartup
gethostbyname
inet_addr
htons
socket
connect
recv
send
closesocket
wininet
InternetCrackUrlA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
netapi32
NetShareAdd
NetShareDel
NetApiBufferFree
NetShareEnum
mpr
WNetAddConnection2A
kernel32
WriteConsoleA
HeapSize
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RaiseException
LCMapStringW
LCMapStringA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapCreate
HeapReAlloc
Sleep
GetLastError
CreateThread
GetModuleFileNameA
ExitThread
LeaveCriticalSection
EnterCriticalSection
GetTickCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
ReadFile
WriteFile
TransactNamedPipe
CloseHandle
CreateFileA
WaitForSingleObject
CreateEventA
CreateProcessA
ExpandEnvironmentStringsA
GetModuleHandleA
GetSystemDirectoryA
DeleteFileA
GetConsoleOutputCP
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
FreeLibrary
LoadLibraryA
GetCurrentProcess
GetProcAddress
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileA
FindFirstFileA
SetFilePointer
GetFileSize
GetTimeFormatA
GetDateFormatA
GetFileAttributesA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
WideCharToMultiByte
SetFileAttributesA
CopyFileA
Module32First
TerminateProcess
lstrcmpiA
OpenProcess
lstrcpynA
lstrcmpA
lstrlenA
GetComputerNameA
GetLocaleInfoA
GetVersionExA
GetStdHandle
AllocConsole
GetLocalTime
GetCurrentProcessId
GetWindowsDirectoryA
ExitProcess
CreateMutexA
GetTempPathA
GlobalMemoryStatus
TerminateThread
GetLogicalDrives
QueryPerformanceCounter
QueryPerformanceFrequency
VirtualAlloc
VirtualFree
WriteConsoleW
SetEndOfFile
GetProcessHeap
GetDriveTypeA
lstrcpyA
InterlockedDecrement
GetCurrentThreadId
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
GetModuleHandleW
RtlUnwind
GetCommandLineA
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
user32
FindWindowA
wsprintfA
SendMessageA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegCloseKey
GetUserNameA
shell32
ShellExecuteA
Sections
.text Size: 141KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 456KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ