Static task
static1
Behavioral task
behavioral1
Sample
0ce943556406d91811a4eb1d070b444f_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0ce943556406d91811a4eb1d070b444f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0ce943556406d91811a4eb1d070b444f_JaffaCakes118
-
Size
20KB
-
MD5
0ce943556406d91811a4eb1d070b444f
-
SHA1
7d9483ea7086895350b8293fb6153a9386f09b53
-
SHA256
e4ed986f0b229a9442420cb0c21a155813fc8d441c676a3493ebb206676f4583
-
SHA512
2ed24a3b573f11020e017c4e446a1077aaf02845c2737f7cb38b165cb24e7c7e1bc2bdfa544caa1c2b1f573e68e8a60f3811027e69235c9cf638b32ef598e42c
-
SSDEEP
192:aqMP1cFRvBxp0VBeIAv+06MaeBjXqfhZDr99zHJYu5AL+KNP1oy:jG1evETeHv+tW+5Fr9x5Az1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ce943556406d91811a4eb1d070b444f_JaffaCakes118
Files
-
0ce943556406d91811a4eb1d070b444f_JaffaCakes118.exe windows:4 windows x86 arch:x86
07fc78b55da26baa9dc81ea481ed530c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileAttributesA
GetSystemDirectoryA
GetModuleFileNameA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
GetProcAddress
GetModuleHandleA
GetTempPathA
VirtualAllocEx
lstrlenW
OpenProcess
MultiByteToWideChar
CreateProcessA
GetStartupInfoA
GetCurrentProcessId
CopyFileA
GetEnvironmentVariableA
GetFileTime
SetFileTime
SetFilePointer
CloseHandle
ReadFile
lstrcpyA
lstrcatA
GetLastError
Sleep
CreateFileA
WriteFile
WriteProcessMemory
user32
wsprintfA
advapi32
QueryServiceConfigA
ChangeServiceConfigA
CreateServiceA
OpenSCManagerA
OpenServiceA
ControlService
QueryServiceStatus
CloseServiceHandle
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
StartServiceA
ole32
CoCreateGuid
msvcrt
_XcptFilter
_controlfp
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
__CxxFrameHandler
_EH_prolog
strchr
memcpy
_except_handler3
_exit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE