Static task
static1
Behavioral task
behavioral1
Sample
35030502cee7008b0b9fc93dbba38c90_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
35030502cee7008b0b9fc93dbba38c90_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
35030502cee7008b0b9fc93dbba38c90_JaffaCakes118
-
Size
64KB
-
MD5
35030502cee7008b0b9fc93dbba38c90
-
SHA1
9eff3c258c041c93b24bdb7b5f673ca2dbdca511
-
SHA256
cb06658b581c3f2af327052205e3278c90912d399e268a827caf16ef96649889
-
SHA512
ef170e1701ade5ef5d8e3a3ce731d50eb40949a008c8f5ab2291c7d2858afdd0b38584aaf2133a6ca2a488e95b6ef8898952e3c0597f2f87984baaac2004a81e
-
SSDEEP
768:OOn3UhmkGBZP2WNuOtymRfCjEHWed7C5NMOzZ/8ENCS87EMYvfI5bEo:O7hKBZPHLf1h7Q5NCS8AvvfHo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 35030502cee7008b0b9fc93dbba38c90_JaffaCakes118
Files
-
35030502cee7008b0b9fc93dbba38c90_JaffaCakes118.exe windows:4 windows x86 arch:x86
7275f09e1fec1e2853f2f3cb2cbf58b1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
GetExitCodeProcess
CopyFileA
WaitForSingleObject
HeapAlloc
GetStdHandle
CloseHandle
WriteFile
ReadFile
HeapFree
GetProcAddress
GetModuleHandleA
FreeLibrary
LoadLibraryA
FindNextChangeNotification
WaitForMultipleObjects
GetLastError
ExitProcess
FindFirstChangeNotificationA
SetCurrentDirectoryA
ExitThread
CreateThread
GetTempPathA
GetVolumeInformationA
GetSystemDirectoryA
GetDriveTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
SetStdHandle
RtlUnwind
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
SetEndOfFile
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
SetFilePointer
FindFirstFileA
FindNextFileA
GetCurrentDirectoryA
FindClose
GetTickCount
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetCurrentProcess
TerminateProcess
GetFileType
SetHandleCount
FlushFileBuffers
GetVersion
GetCommandLineA
GetStartupInfoA
DeleteFileA
user32
GetMessageA
TranslateMessage
SendMessageA
FindWindowExA
FindWindowA
PeekMessageA
DispatchMessageA
LoadIconA
GetDlgItem
CreateWindowExA
LoadCursorA
RegisterClassExA
DestroyWindow
DefWindowProcA
SetTimer
PostQuitMessage
advapi32
RegSetValueExA
RegOpenKeyA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
shell32
ShellExecuteExA
ShellExecuteA
ws2_32
recv
WSACleanup
closesocket
send
connect
socket
htons
gethostbyname
WSAStartup
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE