Static task
static1
Behavioral task
behavioral1
Sample
16109df0e8430b1a1c228420b973f281_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
16109df0e8430b1a1c228420b973f281_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
16109df0e8430b1a1c228420b973f281_JaffaCakes118
-
Size
47KB
-
MD5
16109df0e8430b1a1c228420b973f281
-
SHA1
38056944feb0840451ea4d4c6675e6c416bae0dd
-
SHA256
90658b3fe708fdcade2e9f78a4f4ebe0cbb8d4401ce82a52035cbd582a8c6ce3
-
SHA512
6cad820bc10d2f451f35217595951e4f8dbfff39216b7878f9e8da0f194e6768fa6d080577f219d19494f1ac5821317ca7160b97348c9dd7ab6ce0447886b5bc
-
SSDEEP
768:1w1rE5Ia/8X2kibnndQXLosAwNuEE6iSvmztMEnwFlipnn:1c08BSWLL3iSvmzt1wjunn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16109df0e8430b1a1c228420b973f281_JaffaCakes118
Files
-
16109df0e8430b1a1c228420b973f281_JaffaCakes118.exe windows:4 windows x86 arch:x86
fa9f526a415c082f3b22050d721b7668
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
AddAtomA
CloseHandle
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FindAtomA
GetAtomNameA
GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
GetTickCount
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TerminateThread
WideCharToMultiByte
msvcrt
_chdir
_strdup
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_errno
_iob
_onexit
_setmode
abort
atexit
atoi
calloc
exit
fclose
fgets
fopen
fputc
free
getenv
localeconv
malloc
memset
rand
signal
srand
strchr
strcmp
strcpy
strlen
strncpy
strstr
strtok
strtol
wcslen
shell32
Shell_NotifyIconA
user32
CallWindowProcA
CreateDialogParamA
DestroyWindow
DialogBoxParamA
DispatchMessageA
EndDialog
GetDlgItem
GetMessageA
IsWindowVisible
KillTimer
LoadIconA
PostQuitMessage
SendMessageA
SetFocus
SetTimer
SetWindowLongA
ShowWindow
TranslateMessage
UpdateWindow
wsock32
WSACleanup
WSAStartup
accept
bind
closesocket
connect
gethostbyname
htons
inet_addr
inet_ntoa
listen
ntohl
recv
select
send
setsockopt
shutdown
socket
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 66KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE