Static task
static1
Behavioral task
behavioral1
Sample
3681785c131d9cb3df939e457baf1e98_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3681785c131d9cb3df939e457baf1e98_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3681785c131d9cb3df939e457baf1e98_JaffaCakes118
-
Size
4.0MB
-
MD5
3681785c131d9cb3df939e457baf1e98
-
SHA1
9125c24a9dace4f980f7c4daee060b1c4d0d4a9d
-
SHA256
bc3f6884ae1cf724275c8d17bbb64f3e1d840b0985959f0fc742262ae4537d4c
-
SHA512
1cc7835797655ce8eee6cb7124d5b825b926aed607f683f9cd8f89e4dfc416a5d064fa17c971af480d280b72ce570d8ac98b90f79f4f750c132e6d13914bcaa6
-
SSDEEP
49152:CeILG5/fpSEWavh4Ey+iNnBi1zDNUjNbmbm5/DgMJcJbSrrMAhhRQODmSWSGuvxz:ZIGNoEnHsg6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3681785c131d9cb3df939e457baf1e98_JaffaCakes118
Files
-
3681785c131d9cb3df939e457baf1e98_JaffaCakes118.exe windows:4 windows x86 arch:x86
93ad90be48a2b592b4e6c8e523494b73
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
send
getpeername
WSACleanup
inet_addr
recv
gethostname
htonl
select
accept
getsockname
WSAStartup
setsockopt
bind
listen
shutdown
closesocket
getservbyname
ntohs
socket
ioctlsocket
htons
WSAGetLastError
connect
gethostbyaddr
gethostbyname
kernel32
InterlockedExchangeAdd
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
CloseHandle
SetNamedPipeHandleState
WaitNamedPipeA
CreateFileA
GetLastError
SetEvent
Sleep
DisconnectNamedPipe
CancelIo
LocalFree
FormatMessageA
CreateNamedPipeA
ConnectNamedPipe
WaitForSingleObject
CreateEventA
FreeConsole
SetThreadPriority
GetCurrentThread
GetCurrentProcessId
GetVersionExA
ResumeThread
GetCurrentProcess
LocalAlloc
lstrcpyA
InterlockedIncrement
GetModuleFileNameA
GetProcAddress
LoadLibraryExA
FreeLibrary
ReadFile
WriteFile
CreateSemaphoreA
InterlockedDecrement
ReleaseSemaphore
GetWindowsDirectoryA
CreateThread
GetLocalTime
GetFileSize
FlushFileBuffers
SetFilePointer
GetOverlappedResult
ResetEvent
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
VirtualAlloc
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
LoadLibraryA
GetOEMCP
CompareStringA
CompareStringW
QueryPerformanceCounter
GetTickCount
VirtualProtect
GetSystemInfo
VirtualQuery
SetEndOfFile
GetLocaleInfoW
DeleteFileA
SetFileAttributesA
RemoveDirectoryA
GetFileInformationByHandle
PeekNamedPipe
UnlockFile
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetCurrentDirectoryA
CreateDirectoryA
LockFile
lstrlenA
GetACP
LCMapStringW
LCMapStringA
GetCurrentDirectoryA
GetDriveTypeA
RtlUnwind
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
ExitProcess
GetModuleHandleA
TerminateProcess
ExitThread
TlsSetValue
TlsGetValue
GetFileAttributesA
GetCommandLineA
GetTimeZoneInformation
HeapReAlloc
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
FindNextFileA
MoveFileA
WideCharToMultiByte
MultiByteToWideChar
GetFullPathNameA
RaiseException
TlsFree
SetLastError
TlsAlloc
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
HeapSize
SetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetCPInfo
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
user32
PeekMessageA
SetTimer
KillTimer
MessageBoxA
advapi32
QueryServiceConfigA
RegOpenKeyExA
RegEnumValueA
RegCloseKey
DeleteService
CreateServiceA
StartServiceCtrlDispatcherA
QueryServiceStatus
RegisterServiceCtrlHandlerA
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
OpenSCManagerA
OpenServiceA
CloseServiceHandle
SetServiceStatus
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 368KB - Virtual size: 366KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ