Static task
static1
Behavioral task
behavioral1
Sample
33fcf7dc3509593414f03da424cec6de_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
33fcf7dc3509593414f03da424cec6de_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
33fcf7dc3509593414f03da424cec6de_JaffaCakes118
-
Size
18KB
-
MD5
33fcf7dc3509593414f03da424cec6de
-
SHA1
d7a22f378880341d2e18c64ca5b1898ec2d0a2f9
-
SHA256
a578b0e54b3b6581c13083d114c3995523cf6a154db507897ab620f3e0567242
-
SHA512
daad79c54d305396acc94bbfc518fe50f32ecaef11c3baf14733025a88ded03df02a02b3a16d4ceea025e8686f8d5e40624dd92b46e9492100d4f68848752b9b
-
SSDEEP
384:HcszsBl0O9eUTFzYAWx+qSknDzWuBWfcBpLB61QBe6sSC:SdTq9fDt6cBlfC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 33fcf7dc3509593414f03da424cec6de_JaffaCakes118
Files
-
33fcf7dc3509593414f03da424cec6de_JaffaCakes118.exe windows:5 windows x86 arch:x86
aa87eacb0fde38399883a81cae940f63
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_stricmp
strstr
sprintf
wcscpy
exit
_wcsicmp
_c_exit
_exit
_XcptFilter
_cexit
__winitenv
__wgetmainargs
_initterm
printf
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExW
kernel32
GetModuleFileNameW
GetWindowsDirectoryW
GetCurrentProcessId
ProcessIdToSessionId
LoadLibraryW
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
ExpandEnvironmentStringsW
GetLastError
GetModuleHandleW
LocalAlloc
LocalFree
VirtualAlloc
VirtualFree
FreeLibrary
GetModuleHandleA
ntdll
NtOpenFile
NtClose
DbgPrint
NtQuerySystemInformation
RtlInitUnicodeString
rasapi32
RasGetAutodialParamW
RasGetAutodialAddressW
RasEnumAutodialAddressesW
rasdlg
RasAutodialQueryDlgW
RasPhonebookDlgW
RasDialDlgW
shlwapi
StrCatW
tapi32
lineShutdown
lineInitialize
lineGetTranslateCapsW
ws2_32
WSAStartup
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE