Static task
static1
Behavioral task
behavioral1
Sample
392666103b89dec8c9a3d2c1b82afadf_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
392666103b89dec8c9a3d2c1b82afadf_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
392666103b89dec8c9a3d2c1b82afadf_JaffaCakes118
-
Size
181KB
-
MD5
392666103b89dec8c9a3d2c1b82afadf
-
SHA1
0bd54cc97ab93823ba13aa3248c25875f0a93523
-
SHA256
47c32dc2043479924370da0653b6961ee776c6be28d77f747ef2a3c07f9e63c7
-
SHA512
646bbfd7173a09be7df4dc8163a28eedfe74bc7a03b00c0eea0d675c3a63bbf4eb47637afbc390c62f6cf9a383c7d9cad4256a378c9fe1fdf60e5f1c71bb2626
-
SSDEEP
3072:H5PlSv58F2H+3Rp9+eU27eadZFkCwCd7ZfkmJyCelykctHD:HRlSv5Zehp9HNZFkCwCd7Zfou3t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 392666103b89dec8c9a3d2c1b82afadf_JaffaCakes118
Files
-
392666103b89dec8c9a3d2c1b82afadf_JaffaCakes118.exe windows:4 windows x86 arch:x86
1cb48fbfde169421c22bc39923729ec6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
send
listen
bind
gethostname
inet_addr
shutdown
recv
accept
WSAGetLastError
__WSAFDIsSet
select
ioctlsocket
gethostbyname
connect
WSAStartup
socket
WSACleanup
inet_ntoa
closesocket
htons
htonl
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
HeapSize
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetCurrentProcessId
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
InitializeCriticalSection
FlushFileBuffers
SetStdHandle
GetLastError
Sleep
CloseHandle
GetExitCodeThread
WaitForSingleObjectEx
GetTickCount
QueryPerformanceCounter
ReleaseMutex
WaitForSingleObject
CreateMutexA
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
ExpandEnvironmentStringsA
GetSystemDirectoryA
OpenProcess
TerminateProcess
ReleaseSemaphore
CreateSemaphoreA
CreateFileA
ReadFile
WriteFile
SetEndOfFile
CreateProcessA
GetCurrentProcess
GetExitCodeProcess
DeleteFileA
TerminateThread
GetModuleHandleA
GetSystemInfo
WideCharToMultiByte
CopyFileA
SetFileAttributesA
GetFileAttributesA
MultiByteToWideChar
InterlockedDecrement
GetStdHandle
SetHandleCount
LCMapStringA
VirtualQuery
VirtualProtect
IsBadWritePtr
VirtualAlloc
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
LeaveCriticalSection
EnterCriticalSection
UnhandledExceptionFilter
ExitProcess
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
GetCommandLineA
GetStartupInfoA
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetLastError
GetCPInfo
GetOEMCP
lstrlenA
LocalFree
GetFileType
SetFilePointer
InterlockedExchange
CreateDirectoryA
RaiseException
GetACP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
RtlUnwind
HeapReAlloc
HeapAlloc
HeapFree
ExitThread
GetCurrentThreadId
CreateThread
GetSystemTimeAsFileTime
user32
GetDC
CreateDialogParamA
GetMessageA
DispatchMessageA
TranslateMessage
GetDlgItem
IsDlgButtonChecked
FindWindowExA
DestroyWindow
ShowWindow
SetWindowTextA
PostQuitMessage
GetWindowPlacement
GetSystemMetrics
SetWindowPlacement
MessageBoxA
PostMessageA
IsWindow
GetWindowThreadProcessId
GetWindowLongA
SendMessageA
EnumWindows
gdi32
DeleteObject
CreateSolidBrush
SetBkColor
GetDeviceCaps
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
ole32
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
Sections
.text Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ