Static task
static1
Behavioral task
behavioral1
Sample
3d0964d1c124830b123f2507568f3fda_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3d0964d1c124830b123f2507568f3fda_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3d0964d1c124830b123f2507568f3fda_JaffaCakes118
-
Size
6KB
-
MD5
3d0964d1c124830b123f2507568f3fda
-
SHA1
668829d15d4bfbc64753fc257738c3351a542c36
-
SHA256
42bea50ec98cecfd171014a4eb0fdaab9a43f789607ea9a395eca591cf0f45d7
-
SHA512
a4d58e362d22f9a7148aa9cdcc1876d24fb06cb166e1f1c712bcb4d8eecbee13defe8f822271b5f099f5b7258597e94b2ad1c6954011765f27e433d7bef7551b
-
SSDEEP
96:5FNSOWfaX7Yzzp7NCeDxsKURtHNSwZk/dR06A2:FwrzzpxDdsK0/9ZGdRG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d0964d1c124830b123f2507568f3fda_JaffaCakes118
Files
-
3d0964d1c124830b123f2507568f3fda_JaffaCakes118.exe windows:4 windows x86 arch:x86
fa091b54891f5147017a42a2a26cfead
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualProtect
GetModuleFileNameA
GetWindowsDirectoryA
WinExec
GetTempPathA
ReadProcessMemory
GetCurrentProcessId
SetUnhandledExceptionFilter
CreateSemaphoreA
GetCurrentThreadId
CloseHandle
GetLastError
GetProcessHeap
HeapAlloc
CreateThread
HeapFree
Sleep
user32
PostThreadMessageA
GetInputState
GetMessageA
wsprintfA
advapi32
RegCloseKey
RegSetValueExA
RegOpenKeyA
iphlpapi
GetTcpTable
ws2_32
socket
gethostbyname
WSAStartup
send
connect
htons
inet_addr
recv
closesocket
gethostname
wininet
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
DeleteUrlCacheEntry
urlmon
URLDownloadToFileA
msvcrt
_strlwr
memcpy
memset
rand
srand
_stricmp
strlen
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE