Static task
static1
Behavioral task
behavioral1
Sample
10103f88ee06ed9f356cd989876aef28_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
10103f88ee06ed9f356cd989876aef28_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
10103f88ee06ed9f356cd989876aef28_JaffaCakes118
-
Size
46KB
-
MD5
10103f88ee06ed9f356cd989876aef28
-
SHA1
278f72f92ca71af97196159c6976f053a6c20ac3
-
SHA256
919cd55a70f404ab9d8046cef74aa79f42d9d1d6c434a813d38b05a04931c9ba
-
SHA512
81ee933e4be9b284a8a57e3b6e3ff1b923f3ddd84b2ce032ae3fff090909d0178245334757932808336f599c0b52bc14f39feb51ace0215344fbe2b1c00fa283
-
SSDEEP
768:Yz1wV+XS+k9ylkrzLMQIjQExSO4+FDtL2lw7z3Fj9wbPk54ZJ4ifMuV:Yyx9mkr0G+hGYVj9wbcqZeixV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 10103f88ee06ed9f356cd989876aef28_JaffaCakes118
Files
-
10103f88ee06ed9f356cd989876aef28_JaffaCakes118.exe windows:5 windows x86 arch:x86
20e41ce01f80755f4eea7fc12deb3017
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
ZwReadFile
ZwQueryInformationFile
strrchr
ZwCreateFile
ZwWriteFile
ZwQueryVolumeInformationFile
ZwQueryDirectoryFile
wcslen
ZwSetInformationFile
RtlAdjustPrivilege
RtlIpv4StringToAddressA
ZwOpenThreadTokenEx
_wcsicmp
strcmp
strcpy
sprintf
memcmp
strchr
ZwSetSecurityObject
LdrAccessResource
wcsrchr
swprintf
strlen
RtlDestroyQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlCreateQueryDebugBuffer
RtlEqualUnicodeString
ZwQuerySystemInformation
ZwSuspendThread
ZwQueryInformationThread
ZwOpenThread
_stricmp
RtlNtStatusToDosError
RtlIpv4AddressToStringA
ZwClose
ZwEnumerateKey
ZwOpenKey
ZwQueryKey
ZwResumeThread
ZwLoadDriver
ZwCreateSymbolicLinkObject
ZwUnmapViewOfSection
ZwFlushVirtualMemory
RtlImageNtHeader
ZwMapViewOfSection
ZwCreateSection
ZwFsControlFile
ZwOpenFile
ZwSetValueKey
ZwCreateKey
LdrFindResource_U
RtlInitUnicodeString
ZwAdjustPrivilegesToken
memset
RtlIpv4StringToAddressW
ZwQueryValueKey
ZwImpersonateThread
memcpy
kernel32
DeleteTimerQueueTimer
Sleep
GetVersion
ExitProcess
GetTickCount
CreateTimerQueueTimer
VirtualAlloc
GetSystemTimeAsFileTime
GetLastError
BindIoCompletionCallback
LocalFree
LocalAlloc
advapi32
MD5Update
MD5Final
MD5Init
ws2_32
WSACleanup
WSARecvFrom
WSASendTo
setsockopt
WSASend
WSARecv
WSAIoctl
bind
closesocket
WSAGetLastError
WSASocketW
WSAStartup
cabinet
ord20
ord22
ord23
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 432B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ