Static task
static1
Behavioral task
behavioral1
Sample
24cd129f9e1d18d6fcbd956ff4a29ad5_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
24cd129f9e1d18d6fcbd956ff4a29ad5_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
24cd129f9e1d18d6fcbd956ff4a29ad5_JaffaCakes118
-
Size
27KB
-
MD5
24cd129f9e1d18d6fcbd956ff4a29ad5
-
SHA1
d3d33dce0f571c50dc3aea2bd6a88439a9e56b7c
-
SHA256
76f4ef21b13e37e7ebe19da4856eba4a1791608d8d61a0c89fa27aa19ac08010
-
SHA512
d94bbbc5c541e06cf6dc81e44a8d012a594f16e1193444c053618e2b6189879a0f8f262ac34e4686c741a9023e438947edcc7b85b780c6bc17e07a9214448cfe
-
SSDEEP
384:jSXfBjWZ054NfmPQSj/2ZWEDmVJNbtOhtIKElFNHXFbkxkqrD35SN3XK9ZjYE0Wz:WZ54D8ED+JN5OhtI5bRFgaUD35SpXKw6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 24cd129f9e1d18d6fcbd956ff4a29ad5_JaffaCakes118
Files
-
24cd129f9e1d18d6fcbd956ff4a29ad5_JaffaCakes118.exe windows:4 windows x86 arch:x86
d2de2cd19964c523cccf292a65040117
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSASocketA
htonl
sendto
inet_addr
WSAGetLastError
WSAAsyncSelect
WSAStartup
getprotobyname
socket
gethostbyname
setsockopt
htons
connect
send
recv
closesocket
WSACleanup
kernel32
WriteProcessMemory
GetProcAddress
GetModuleHandleA
VirtualProtectEx
VirtualAllocEx
VirtualAlloc
lstrcatA
HeapFree
HeapAlloc
GetProcessHeap
SetThreadContext
WideCharToMultiByte
MultiByteToWideChar
GetSystemDirectoryA
GetTickCount
SetPriorityClass
GetCurrentProcess
FreeLibrary
GetCurrentProcessId
LoadLibraryA
GetVersion
CreateThread
Sleep
CloseHandle
CreateMutexA
ExitProcess
GetCommandLineA
GetModuleFileNameA
DeleteFileA
MoveFileA
ResumeThread
GetVersionExA
GetComputerNameA
GetFileAttributesA
GetCurrentThreadId
WriteFile
CreateFileA
TerminateProcess
CreateProcessA
GetThreadContext
ReadProcessMemory
VirtualQueryEx
GetStartupInfoA
GetLastError
GlobalMemoryStatus
user32
DefWindowProcA
ExitWindowsEx
PostQuitMessage
RegisterClassA
PostThreadMessageA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
GetInputState
CreateWindowExA
advapi32
RegSetValueA
RegSetValueExA
LookupPrivilegeValueA
RegCloseKey
GetUserNameA
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
AddAce
GetAce
EqualSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
AdjustTokenPrivileges
RegDeleteKeyA
RegOpenKeyA
RegCreateKeyA
SetFileSecurityA
GetSecurityDescriptorControl
OpenProcessToken
msvcp60
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
wininet
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
netapi32
NetApiBufferFree
NetUserGetLocalGroups
msvcrt
_itoa
ftell
fseek
fclose
fopen
fread
sprintf
rand
strstr
atoi
strncpy
strcspn
__CxxFrameHandler
malloc
_strlwr
_except_handler3
Sections
���� Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
���� Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
� �� Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
���� Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE