Static task
static1
Behavioral task
behavioral1
Sample
3a22131181495f2df4eca9d661883574_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3a22131181495f2df4eca9d661883574_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3a22131181495f2df4eca9d661883574_JaffaCakes118
-
Size
46KB
-
MD5
3a22131181495f2df4eca9d661883574
-
SHA1
8561afdf0d90e77b3108899309a5e75fad620fea
-
SHA256
4f0f7c616f58b87ed12cdba3a7f6f3ee53cdf9821eccf8c5063c62dc6ccfee90
-
SHA512
886e21f9fb2a6a7ee0c0ffac9288ab22e04b5743b3285a8aa1445a986fc4b134bdeba12ba303bd080197603679624b11addfbaa89bdaf91bd721420fd9896348
-
SSDEEP
768:L2WY6vky8wAIiYvTkzQ7n9LRPqJmeQxkzS31GhWmzEaSfaNdG6y4c:ixWkdwAMTmgPTkYmzlNW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a22131181495f2df4eca9d661883574_JaffaCakes118
Files
-
3a22131181495f2df4eca9d661883574_JaffaCakes118.exe .js windows:4 windows x86 arch:x86 polyglot
46d46037a6f0f57fac046d03f5960235
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord354
ord665
ord537
ord2915
ord535
ord3522
ord858
ord3521
ord6402
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord3401
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord3953
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord800
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord815
ord825
ord823
ord540
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
__dllonexit
srand
rand
_wcsicmp
memcmp
tmpnam
wcscat
fgetc
memcpy
div
sprintf
_unlink
__CxxFrameHandler
??1type_info@@UAE@XZ
_CxxThrowException
_wcsupr
strstr
strcpy
_strdup
strcat
free
memset
_splitpath
_strcmpi
exit
_except_handler3
wcslen
strlen
fopen
fprintf
fclose
kernel32
GetExitCodeProcess
OpenProcess
GetProcessHeap
HeapAlloc
HeapFree
WideCharToMultiByte
GetFileSize
GetVersionExA
GetWindowsDirectoryA
CreateFileA
GetFileTime
CloseHandle
SetFileTime
GetSystemDirectoryA
GetLastError
CreateThread
GetSystemDefaultLCID
GetTickCount
MultiByteToWideChar
GetCurrentProcessId
ReadFile
CreateFileW
DuplicateHandle
GetCurrentProcess
VirtualAlloc
VirtualFree
CompareStringW
GetSystemDirectoryW
GetVersion
lstrcatA
lstrcpyA
lstrcpynA
lstrcmpA
InterlockedIncrement
InterlockedDecrement
LocalFree
LocalAlloc
DeleteFileA
GetProcAddress
LoadLibraryA
CreateMutexA
GetModuleFileNameA
FreeResource
WriteFile
LockResource
LoadResource
SizeofResource
TerminateProcess
FindResourceA
GetModuleHandleA
Sleep
lstrlenA
MoveFileW
GetStartupInfoA
GetCurrentThreadId
GetLocaleInfoA
user32
EnumWindows
DispatchMessageA
TranslateMessage
GetMessageA
GetDC
wsprintfW
IsCharAlphaNumericA
wsprintfA
GetSystemMetrics
gdi32
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
advapi32
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
LookupAccountSidA
GetTokenInformation
OpenProcessToken
ole32
CoCreateInstance
OleUninitialize
OleInitialize
oleaut32
VariantCopy
SysAllocStringLen
SysAllocString
VariantClear
VariantInit
GetErrorInfo
SafeArrayCreateVector
SysFreeString
SafeArrayUnaccessData
SafeArrayAccessData
ws2_32
select
ioctlsocket
socket
connect
htons
accept
__WSAFDIsSet
recv
WSAStartup
closesocket
send
wininet
FindNextUrlCacheEntryA
DeleteUrlCacheEntry
FindCloseUrlCache
FindFirstUrlCacheEntryA
gdiplus
GdipGetImageEncodersSize
GdipGetImageEncoders
Sections
.text Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE