Static task
static1
Behavioral task
behavioral1
Sample
3036983e00f81920c933031d484d2f9d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3036983e00f81920c933031d484d2f9d_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
3036983e00f81920c933031d484d2f9d_JaffaCakes118
-
Size
196KB
-
MD5
3036983e00f81920c933031d484d2f9d
-
SHA1
d8576ea6d86e707e729003ed41e6ece1f74a75d7
-
SHA256
2e72fd7de049db44bb748136445de20c63db543a964c2a425ec0588f3a350a35
-
SHA512
e7b99d2c8831d69f6d13151ae834f917056d58b151cb8970b43a1c811aeb5f70bc99d6b0a373d864fe3fed2971a97fae276e0af2313767e0d4a44b0ac6e2e6e6
-
SSDEEP
1536:H2oupzdFJROQCyG69sJJHfY2hOGPHhI0NPVc4iw9gVQ/Xx0AKolUz:+dXoWds7HfYlGPBbNPVct+g2/X6AKolM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3036983e00f81920c933031d484d2f9d_JaffaCakes118
Files
-
3036983e00f81920c933031d484d2f9d_JaffaCakes118.exe windows:4 windows x86 arch:x86
7fb1e3fd1fa6c2a6391dcbb91f034c2b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyA
WinExec
Sleep
CopyFileA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetModuleFileNameA
GetDriveTypeA
CreateDirectoryA
CreateFileA
WriteFile
SetFileAttributesA
lstrcmpiA
CreateProcessA
GetStringTypeA
LCMapStringW
LCMapStringA
ReadFile
SetEndOfFile
FlushFileBuffers
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
DebugBreak
GetStdHandle
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
TerminateProcess
GetCurrentProcess
GetLastError
GetFileAttributesA
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
SetFilePointer
IsBadWritePtr
IsBadReadPtr
HeapValidate
SetConsoleCtrlHandler
CloseHandle
GetExitCodeProcess
WaitForSingleObject
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
MultiByteToWideChar
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetStringTypeW
advapi32
RegSetValueExA
RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegCreateKeyExA
ws2_32
WSASocketA
htons
inet_addr
connect
WSAStartup
Sections
.text Size: 152KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ