Static task
static1
Behavioral task
behavioral1
Sample
08f9b0718850559affd2bbe9feb991a2_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
08f9b0718850559affd2bbe9feb991a2_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
08f9b0718850559affd2bbe9feb991a2_JaffaCakes118
-
Size
200KB
-
MD5
08f9b0718850559affd2bbe9feb991a2
-
SHA1
3947d945ee88c31feeef4061e7fed28fd1d55c0d
-
SHA256
21af0555b983c73cb3c97d9427e6f7f272f0720b6154d0c6e4827546cec97968
-
SHA512
944c59c6f519e3c8a143ad97ae17d2e0068569ee0456e224ca49fb9f3af228e8b359cf6f7c3c6e18e654f5a9e8db8b35f50b4ce236fb5f054eb292f30bcc0283
-
SSDEEP
3072:5g0zcSVq7HSDsfxqn0owcgxaeLUljOwd8x8Nqp3MCaoVk:5g85BFHeLptuNqmEV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08f9b0718850559affd2bbe9feb991a2_JaffaCakes118
Files
-
08f9b0718850559affd2bbe9feb991a2_JaffaCakes118.exe windows:4 windows x86 arch:x86
aae61044da656182afa8e338eec3742f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapAlloc
FillConsoleOutputAttribute
SetConsoleScreenBufferSize
GetStdHandle
CloseHandle
OpenMutexA
Sleep
HeapSize
GetProcAddress
GetVersion
FlushFileBuffers
ReadFile
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
MultiByteToWideChar
SetFilePointer
GetLastError
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
WriteFile
ExitProcess
HeapFree
SetConsoleTextAttribute
HeapReAlloc
TerminateProcess
GetCurrentProcess
WideCharToMultiByte
VirtualAlloc
CreateFileA
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetFileType
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
winmm
timeGetTime
wsock32
gethostbyname
recvfrom
getsockopt
socket
htons
bind
gethostname
WSACleanup
setsockopt
inet_ntoa
sendto
closesocket
WSAGetLastError
WSAStartup
htonl
Sections
.text Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
]Uѣ?M Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE