Static task
static1
Behavioral task
behavioral1
Sample
228e4cef07f9a85c15bb33b160e4d3e1_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
228e4cef07f9a85c15bb33b160e4d3e1_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
228e4cef07f9a85c15bb33b160e4d3e1_JaffaCakes118
-
Size
259KB
-
MD5
228e4cef07f9a85c15bb33b160e4d3e1
-
SHA1
a09e650fb59097ec22b80181c9a216016dbe98dc
-
SHA256
d0dd624eb42e04fbeb3d9fcf711c5831171fb725b229f8b304cd5539ab966352
-
SHA512
8830135c54c33abb9f4616bc8768d49808208229c5c638c3c2a32048fdbbe82b69e535ebfecca26baf7908518f8ee9100bd4d8afcf504f1b74c04051ea761e88
-
SSDEEP
6144:l6sLroZp1rpq8SqIgyt9xAqPTEyMbZgpu87GE7ifK+:lBroiKI/fpTEZg02Wj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 228e4cef07f9a85c15bb33b160e4d3e1_JaffaCakes118
Files
-
228e4cef07f9a85c15bb33b160e4d3e1_JaffaCakes118.exe windows:4 windows x86 arch:x86
6aab68ac1399d8e9fba0f351ef5fa357
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
gethostbyname
ntohs
WSAGetLastError
WSAStartup
WSACleanup
gethostbyaddr
inet_ntoa
inet_addr
iphlpapi
SendARP
kernel32
lstrlenW
lstrlenA
SystemTimeToFileTime
GetLocalTime
CreateEventA
WaitForSingleObject
GetExitCodeThread
WaitForMultipleObjects
FreeLibrary
OpenMutexA
GetCurrentThreadId
CreateSemaphoreA
OpenEventA
OpenSemaphoreA
GetModuleHandleA
FileTimeToSystemTime
GetSystemTime
FindResourceA
LoadResource
RaiseException
GetThreadLocale
GetACP
GetProcessHeap
CreateMutexA
lstrcmpA
GetProcAddress
advapi32
CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
RegCreateKeyExA
RegSetValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGetProvParam
CryptDeriveKey
CryptGetHashParam
ole32
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysStringByteLen
VariantInit
VarBstrCmp
SysStringLen
SysFreeString
SysAllocString
VariantClear
quartz
AMGetErrorTextW
DllCanUnloadNow
DllUnregisterServer
DBToAmpFactor
DllGetClassObject
AMGetErrorTextA
wship6
WSHGetSocketInformation
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VI Size: 1024B - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ep Size: 2KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.IG Size: 101KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SJWMGu Size: 4KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zTqxuS Size: 5KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qwsfZ Size: 113KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.T Size: 1024B - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ