Static task
static1
Behavioral task
behavioral1
Sample
2d9c7b8ca4b5c6e82c519a146f28e05b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2d9c7b8ca4b5c6e82c519a146f28e05b_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2d9c7b8ca4b5c6e82c519a146f28e05b_JaffaCakes118
-
Size
76KB
-
MD5
2d9c7b8ca4b5c6e82c519a146f28e05b
-
SHA1
0d833e0994db62309faef4c2cdf3b279cfedb258
-
SHA256
3bd2afcee999f96620756ee6bb4fde5146166080bc768400372a4e69418f9970
-
SHA512
cdf5c7a68dd86604c5f9fa40dabeb2ab4a77496906c0aab5a58b900c0724492de66075c4596e1e628888be17889e161609681d0295f581b850bba1594f32ccd7
-
SSDEEP
1536:VBidHURZStZBWxp4TeNNpvoyClJ2woKKO5U:+URZSr65pYJ2woKKOe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d9c7b8ca4b5c6e82c519a146f28e05b_JaffaCakes118
Files
-
2d9c7b8ca4b5c6e82c519a146f28e05b_JaffaCakes118.exe windows:4 windows x86 arch:x86
29e767983dafdaded8f4b58d29836526
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
SizeofResource
WriteFile
CloseHandle
FindResourceA
LoadResource
FreeResource
SetLastError
HeapFree
lstrcpyA
GetCurrentThreadId
GetPrivateProfileStringA
GetModuleFileNameA
lstrlenA
lstrcatA
MultiByteToWideChar
WideCharToMultiByte
GetSystemDirectoryA
GetTickCount
WritePrivateProfileStringA
Sleep
GetLastError
GetProcessHeap
HeapAlloc
GetModuleHandleA
GetProcAddress
user32
wsprintfA
GetMessageA
PostThreadMessageA
GetInputState
advapi32
InitializeAcl
DeleteService
OpenSCManagerA
OpenServiceA
CloseServiceHandle
StartServiceA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityA
QueryServiceStatus
GetUserNameA
RegQueryValueExA
CreateServiceA
ControlService
shlwapi
SHDeleteKeyA
netapi32
NetUserGetLocalGroups
NetApiBufferFree
msvcrt
_except_handler3
strchr
srand
rand
memcpy
fopen
memset
strlen
_stricmp
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ