Static task
static1
Behavioral task
behavioral1
Sample
1ba53e19be142ddf6acdbabf00450df9_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1ba53e19be142ddf6acdbabf00450df9_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1ba53e19be142ddf6acdbabf00450df9_JaffaCakes118
-
Size
29KB
-
MD5
1ba53e19be142ddf6acdbabf00450df9
-
SHA1
90ebf984bd451c64781f4b8a1c24fe91cf446445
-
SHA256
1fe0dbc387526f8386726fec1360f712ca466b4b9260186556d48b316842d8a5
-
SHA512
178fbd84de257892c8ab1aa2f5b63502d5bb846c6cef302a374edb14c755a26245e1fb3418df2f535263760871db46f018c38fd0547a833e60ee7c168362aab7
-
SSDEEP
768:RVlBvFhoKYVIAtYyrbkAfODwE9WYno86:RJvqIZ8kA2DweWY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1ba53e19be142ddf6acdbabf00450df9_JaffaCakes118
Files
-
1ba53e19be142ddf6acdbabf00450df9_JaffaCakes118.exe windows:4 windows x86 arch:x86
9971596dc7521a692517ba424f223f3b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
_wcsnicmp
RtlInitUnicodeString
ZwOpenSection
ZwClose
memcmp
_chkstk
wcslen
memcpy
wcscpy
wcschr
wcscat
wcsrchr
wcscmp
memset
kernel32
GetProcAddress
LoadLibraryW
GetFullPathNameW
DeleteFileW
RemoveDirectoryW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetDriveTypeW
VirtualFree
GetFileSize
SetFileTime
WriteFile
CopyFileW
MoveFileW
CreateDirectoryW
GetWindowsDirectoryW
GetComputerNameW
GlobalMemoryStatus
FreeLibrary
CreateThread
ExitProcess
UnmapViewOfFile
MapViewOfFile
Sleep
GetTickCount
VirtualAlloc
ReleaseMutex
OpenMutexW
GetSystemDirectoryW
GetModuleFileNameW
GetModuleHandleW
GetCommandLineW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetTempPathW
GetTempFileNameW
CreateFileW
CreatePipe
CreateProcessW
WaitForSingleObject
ReadFile
MultiByteToWideChar
GetLastError
TerminateProcess
GetVersionExW
WideCharToMultiByte
LocalAlloc
LocalFree
GetCurrentProcess
CloseHandle
FindFirstFileW
FindNextFileW
FindClose
GetLocalTime
GetProcessHeap
HeapAlloc
HeapFree
GetFileTime
CreateMutexW
user32
wsprintfW
GetIconInfo
ExitWindowsEx
gdi32
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
BitBlt
GetBitmapBits
GetObjectW
CreateDCW
GetDIBits
DeleteDC
GetDeviceCaps
advapi32
StartServiceW
RegisterServiceCtrlHandlerW
SetServiceStatus
DeleteService
OpenSCManagerW
OpenServiceW
ChangeServiceConfig2W
CloseServiceHandle
RegCreateKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetUserNameW
StartServiceCtrlDispatcherW
AllocateAndInitializeSid
GetTokenInformation
GetLengthSid
InitializeAcl
AddAccessDeniedAce
SetSecurityInfo
FreeSid
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
GetSecurityInfo
SetEntriesInAclW
shell32
StrCpyNW
SHGetFileInfoW
ws2_32
getpeername
recv
connect
gethostbyname
inet_addr
htons
closesocket
socket
WSAStartup
send
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE