Static task
static1
Behavioral task
behavioral1
Sample
17cee229eda792c4c8cccd06fdf40e24_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
17cee229eda792c4c8cccd06fdf40e24_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
17cee229eda792c4c8cccd06fdf40e24_JaffaCakes118
-
Size
111KB
-
MD5
17cee229eda792c4c8cccd06fdf40e24
-
SHA1
44270b7b26378d94ac7cc4fd06987f4297aaccdc
-
SHA256
d50b4ea965141324c22201ad1004ed56d8e7c2bf4177766fc295b3c55482cbb8
-
SHA512
c7a47a92fefc2a421aee528d3f658fb4f4a97fe78a27bfc1ec422c7c26eecec0c0b630887be14c246f91ec0860c753b6d7651f3f4ac46a0c054cb810a7bb3ae7
-
SSDEEP
3072:4+f+23qAfAM2V7K9R6wJjU+H2GH0RF4t+va5:4+f+eq0SxwtU5GHsGt+C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17cee229eda792c4c8cccd06fdf40e24_JaffaCakes118
Files
-
17cee229eda792c4c8cccd06fdf40e24_JaffaCakes118.exe windows:4 windows x86 arch:x86
6cdafea934ff4ec7fcf459c9e1cd3842
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineA
GetCurrentThreadId
OutputDebugStringA
GetFileTime
lstrcatA
WritePrivateProfileStringA
DeleteFileA
FreeResource
lstrlenA
CreateMutexA
SetFileTime
LocalFileTimeToFileTime
GetTempPathA
GetFileAttributesA
lstrcmpA
SetLastError
LocalReAlloc
LocalFree
LocalAlloc
GetLastError
ReleaseMutex
GetModuleFileNameA
CreateFileA
SetFilePointer
ReadFile
Sleep
GetSystemDirectoryA
CopyFileA
GetVersion
LoadLibraryA
GetProcAddress
FreeLibrary
CreateRemoteThread
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
CloseHandle
WriteFile
GetTickCount
user32
wsprintfA
GetInputState
PostThreadMessageA
GetMessageA
MessageBoxA
advapi32
OpenServiceA
CloseServiceHandle
StartServiceA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
CreateServiceA
EnumServicesStatusA
QueryServiceConfigA
UnlockServiceDatabase
ChangeServiceConfigA
LockServiceDatabase
OpenSCManagerA
msvcrt
_strlwr
__dllonexit
_onexit
??1type_info@@UAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
rand
realloc
malloc
strncmp
strtoul
isdigit
rename
sprintf
??2@YAPAXI@Z
strchr
strstr
fclose
fread
fseek
fopen
exit
Sections
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE