Static task
static1
Behavioral task
behavioral1
Sample
0bc3212ada36b7f5fe5e94098171fd28_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0bc3212ada36b7f5fe5e94098171fd28_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0bc3212ada36b7f5fe5e94098171fd28_JaffaCakes118
-
Size
52KB
-
MD5
0bc3212ada36b7f5fe5e94098171fd28
-
SHA1
3ac3bad8a2fe9769a9353b570155bb60d689fc0d
-
SHA256
cdace27992e2b3f3eb33732a96352ac59011590acbda0c8d8edee92d829076c5
-
SHA512
3a41d5976b88a020f88bcaa213776ed2e7ae6bfb65d7080f8ec9c1f10c73b51fb9fec3b0d6044487c8349af8bb236864d909860af9e646ca8eac403039486b6b
-
SSDEEP
768:ThtawcwtRKi+9xhNgi3j3Qc9AIN5eE3dMixtk5x9OyDTV9tt:Th5BK99xAi04AIN57MiHk5x0Utt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bc3212ada36b7f5fe5e94098171fd28_JaffaCakes118
Files
-
0bc3212ada36b7f5fe5e94098171fd28_JaffaCakes118.exe windows:4 windows x86 arch:x86
cf2978eb2a74c1767d2605bc2d1ef10e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
CloseHandle
ReadFile
CreateFileA
GetCurrentDirectoryA
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
VirtualFreeEx
OpenProcess
GetModuleHandleA
SetStdHandle
SetFilePointer
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
HeapReAlloc
VirtualAlloc
HeapAlloc
GetOEMCP
GetCommandLineA
GetVersion
ExitProcess
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
GetLastError
SetConsoleCtrlHandler
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetCPInfo
GetACP
FlushFileBuffers
user32
MessageBoxA
GetWindowThreadProcessId
FindWindowA
shell32
ShellExecuteA
wininet
FtpPutFileA
InternetOpenA
InternetConnectA
InternetCloseHandle
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE