Behavioral task
behavioral1
Sample
2fd7461e5765930aa53d4fced822a515_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2fd7461e5765930aa53d4fced822a515_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2fd7461e5765930aa53d4fced822a515_JaffaCakes118
-
Size
44KB
-
MD5
2fd7461e5765930aa53d4fced822a515
-
SHA1
fc345f857732f3413651ff45fc9237417b302402
-
SHA256
5662d568048ae121764f599188e91e2aa1ccce5539a393ac5be74b2ea0ca4a9f
-
SHA512
564c13304cff68c2907e2e78e8a60f18d9e66b60619be943c1ccad1c75c1da257f7a6373a42f788290e342473b570a76578f930847bd83c500147ab39a5cfd45
-
SSDEEP
384:mFSQHGb8T1MpcvdLtxcnCMu9PceJyY5Ip3EBChgbsLQrOQj7LVKAv2GTB+MBy3Bb:SHq7yCWHBHb6m/XTIey3BnOg
Malware Config
Signatures
-
Detects Kaiten/Tsunami Payload 1 IoCs
resource yara_rule sample family_kaiten2 -
Detects Kaiten/Tsunami payload 1 IoCs
resource yara_rule sample family_kaiten -
Kaiten family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2fd7461e5765930aa53d4fced822a515_JaffaCakes118
Files
-
2fd7461e5765930aa53d4fced822a515_JaffaCakes118.exe windows:4 windows x86 arch:x86
777e9871b72a3a4868ccf11fb26b11a0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
cygwin1
__errno
__main
abort
accept
atoi
atol
bcopy
bind
calloc
close
connect
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fgets
fopen
fork
fputc
free
gethostbyname
getpid
getppid
htons
inet_addr
inet_network
ioctl
kill
listen
malloc
memcpy
memset
ntohl
pclose
popen
pthread_mutex_lock
pthread_mutex_unlock
rand
realloc
recv
select
sendto
setsockopt
sleep
socket
sprintf
srand
strcasecmp
strcat
strcpy
strdup
strlen
strncmp
strncpy
strtok
strtoul
time
toupper
vsprintf
waitpid
write
kernel32
AddAtomA
FindAtomA
GetAtomNameA
GetModuleHandleA
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE