Static task
static1
Behavioral task
behavioral1
Sample
2b6a58df2d474a6f0e7fad22583447b1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2b6a58df2d474a6f0e7fad22583447b1_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2b6a58df2d474a6f0e7fad22583447b1_JaffaCakes118
-
Size
22KB
-
MD5
2b6a58df2d474a6f0e7fad22583447b1
-
SHA1
54c451e67561497649701cd50b789b49fbde97c8
-
SHA256
66b10c7183b17ab701fadd3a2fca52cae887b2438e005d9e4b1b1d8e3f0272e1
-
SHA512
64b51c8dcef7af0fa0b5766140ab234c7acd464206536c330a143a999146194dc44ed849e4396da389f9163f7d0a930abfae4cc68531fc5c042ee121f9745ac6
-
SSDEEP
384:RCAVpr2v3D8e7G3Zh1m1p3us3uPCgNA658wKrKst/ArfAKBqzayAjbm1NeLNek+l:nVprgnmZrm1p+s+PCS7587tWsGyubu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b6a58df2d474a6f0e7fad22583447b1_JaffaCakes118
Files
-
2b6a58df2d474a6f0e7fad22583447b1_JaffaCakes118.exe windows:1 windows x86 arch:x86
dff51b6772cbaca58a959d3227e1b6c3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegQueryValueExA
RegEnumValueA
RegEnumKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
OpenSCManagerA
CreateServiceA
StartServiceA
ControlService
DeleteService
CloseServiceHandle
RegDeleteValueA
OpenServiceA
QueryServiceStatus
GetUserNameA
RegCreateKeyExA
kernel32
MoveFileA
GetLocalTime
SetUnhandledExceptionFilter
FreeLibrary
lstrlen
GetWindowsDirectoryA
GetStartupInfoA
lstrcmp
GetFileAttributesA
lstrcat
CreateProcessA
lstrcpy
GetSystemDirectoryA
GetTickCount
CopyFileA
DeviceIoControl
SetFileAttributesA
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
SetFilePointer
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
GetLastError
ExitProcess
SetCurrentDirectoryA
WriteFile
GetVersionExA
LoadLibraryA
LoadLibraryExA
GetProcAddress
GetModuleHandleA
GetFileSize
GetModuleFileNameA
GetCommandLineA
LocalAlloc
LocalFree
GetCurrentThread
GetCurrentThreadId
CreateFileA
ReadFile
CloseHandle
Sleep
GetSystemTime
user32
GetSystemMetrics
CharLowerA
SendMessageA
SetWindowsHookExA
SetKeyboardState
ToAscii
MessageBoxA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
ShowWindow
UpdateWindow
ValidateRect
GetCursorPos
WindowFromPoint
GetWindowTextA
CallNextHookEx
RegisterSystemThread
LoadCursorA
LoadIconA
RegisterClassExA
CreateWindowExA
DefWindowProcA
PostQuitMessage
SetCursor
ExitWindowsEx
gdi32
CreateDIBSection
CreatePalette
DeleteObject
RealizePalette
SelectPalette
CreateDCA
DeleteDC
SelectObject
CreateCompatibleDC
SetPixel
BitBlt
GetStockObject
ntdll
NtQuerySystemInformation
RtlAnsiStringToUnicodeString
ZwDeleteFile
wsock32
WSAAsyncSelect
getpeername
inet_addr
bind
connect
ioctlsocket
recv
send
WSACleanup
closesocket
WSAStartup
socket
WSAGetLastError
WSACancelBlockingCall
WSAUnhookBlockingHook
WSASetBlockingHook
gethostbyname
wininet
InternetGetConnectedState
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
HttpQueryInfoA
FtpPutFileA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
Sections
code Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
data Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bss Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
imports Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
relocs Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resource Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ