Static task
static1
Behavioral task
behavioral1
Sample
0995433f25ef0955d936d08dd070293c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0995433f25ef0955d936d08dd070293c_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0995433f25ef0955d936d08dd070293c_JaffaCakes118
-
Size
86KB
-
MD5
0995433f25ef0955d936d08dd070293c
-
SHA1
d9ade89d5be80a3be051c284af2fd4f47b812a35
-
SHA256
cc1ef0a9460a497c54daefb8dbe783f83a07cc597aafb1335187014942d21bfe
-
SHA512
b81f65726fca65641916f4cc1f945d13a08143553fd3f29b5b38594eeeeb3f144f7a6010023fa173c0e79f5a9e62e941fc9a2530a3b52bf5fa9ff096588f5e35
-
SSDEEP
1536:ZEGxLTw4dsjGm7ApbfCdKDhhttp6nJq/t3pb880v:84d0Gge6CDtp6nJq/t3+8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0995433f25ef0955d936d08dd070293c_JaffaCakes118
Files
-
0995433f25ef0955d936d08dd070293c_JaffaCakes118.exe windows:4 windows x86 arch:x86
0f2941d8cb68a9f91b61ace2525ff100
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
shutdown
inet_ntoa
ioctlsocket
ntohl
htonl
getsockname
gethostbyname
WSAStartup
select
inet_addr
connect
send
recv
htons
socket
setsockopt
bind
listen
accept
closesocket
WSACleanup
shell32
SHGetFolderPathA
advapi32
RegQueryValueExA
RegDeleteValueA
GetUserNameA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
wininet
InternetReadFile
InternetOpenA
InternetOpenUrlA
kernel32
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
ReadFile
HeapReAlloc
SetStdHandle
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
GetTickCount
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
CloseHandle
GetCurrentProcess
FindClose
FindFirstFileA
ExitThread
DeleteFileA
SetFileAttributesA
TerminateProcess
OpenProcess
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetWindowsDirectoryA
GetSystemDirectoryA
Sleep
ExitProcess
CreateProcessA
CreateThread
GetModuleFileNameA
WaitForSingleObject
CreateMutexA
SetErrorMode
SetEndOfFile
GetTempPathA
GetLastError
CreateDirectoryA
GetVersionExA
TerminateThread
ExpandEnvironmentStringsA
GetFileAttributesA
GetModuleHandleA
WriteFile
CreateFileA
CopyFileA
GetProcAddress
LoadLibraryA
MultiByteToWideChar
SetFileTime
GetFileTime
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetEnvironmentVariableA
GetVersion
GetCommandLineA
GetStartupInfoA
HeapFree
HeapAlloc
user32
CharLowerA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
Sections
.text Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE