Static task
static1
Behavioral task
behavioral1
Sample
18fc6801d7f5d4c688eb6888f20fe464_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
18fc6801d7f5d4c688eb6888f20fe464_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
18fc6801d7f5d4c688eb6888f20fe464_JaffaCakes118
-
Size
44KB
-
MD5
18fc6801d7f5d4c688eb6888f20fe464
-
SHA1
2647f556f2e7684d1090cad6b7902291f70af96b
-
SHA256
f1830bd62add7118ae267e0827ff4f84b452b7516ea22980977d3e179424ea5f
-
SHA512
987ab928c7bad7af7248e9305bcb5663e2705e4850549082c2cabfda097ed66c4f792b521527053e8e32e3af6f8b260a29fbb7a3b87bd827f8082762d89fb4b6
-
SSDEEP
768:CrU0gJw0nOwf+EXGQHwaytWeHGT0X3O0tSi:P0m71GQQaPeHGY7tT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 18fc6801d7f5d4c688eb6888f20fe464_JaffaCakes118
Files
-
18fc6801d7f5d4c688eb6888f20fe464_JaffaCakes118.exe windows:4 windows x86 arch:x86
88ba2b269731ca5cd6e61d05cdf5d778
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
CopyFileA
lstrcatA
GetLocalTime
lstrlenA
_lwrite
DeleteFileA
_lclose
_lcreat
GetSystemDirectoryA
lstrcpyA
GetTickCount
CreateThread
WinExec
Sleep
LCMapStringA
ReadFile
SetEndOfFile
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
CreateFileA
FlushFileBuffers
SetStdHandle
HeapReAlloc
VirtualAlloc
HeapAlloc
SetFilePointer
GetStringTypeW
GetStringTypeA
RtlUnwind
VirtualFree
LCMapStringW
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
GetLastError
CloseHandle
WriteFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
advapi32
RegSetValueExA
RegCloseKey
RegCreateKeyExA
ws2_32
recv
send
socket
htons
inet_addr
ioctlsocket
connect
select
closesocket
WSAStartup
WSACleanup
inet_ntoa
mpr
WNetAddConnection2A
WNetCancelConnection2A
netapi32
NetApiBufferFree
NetUserEnum
NetScheduleJobAdd
NetRemoteTOD
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE