Static task
static1
Behavioral task
behavioral1
Sample
3e9142f0ddb9105dccc995fb4d65572c_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3e9142f0ddb9105dccc995fb4d65572c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3e9142f0ddb9105dccc995fb4d65572c_JaffaCakes118
-
Size
67KB
-
MD5
3e9142f0ddb9105dccc995fb4d65572c
-
SHA1
0bf3f61c7e6e3daf0f6729d13b1679703c271eaf
-
SHA256
c76b630333334ec0e8c8dd620797cb6f784eba6553310f52765af1d01721c4f3
-
SHA512
3b82d84b03291b1e29c88621279a7fd6e05e1fed3cba34a5f3b273336c5986dcb4afa9d1cea3bb3bbcaba205d364bcac7c1dc871715c5e4d44dbeeb9b6566591
-
SSDEEP
1536:PD/slswWLrB/wukKo2F6HBKLL+l768laljn5i7KQj:rkls/Lr2hKo2FUBA+Q8wJno2M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e9142f0ddb9105dccc995fb4d65572c_JaffaCakes118
Files
-
3e9142f0ddb9105dccc995fb4d65572c_JaffaCakes118.exe windows:4 windows x86 arch:x86
82143bf95b69eac8fb1aeb646ccbd20c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitThread
lstrlenA
VirtualFree
VirtualProtectEx
GetCurrentProcess
WaitForSingleObject
ResumeThread
SetThreadContext
GetThreadContext
lstrcatA
lstrcpyA
GetComputerNameA
GetVolumeInformationA
GetProcAddress
GetModuleHandleA
InitializeCriticalSection
CreateDirectoryA
LoadLibraryA
DeleteFileA
GetCurrentThread
lstrcmpiA
CreateThread
CloseHandle
lstrcmpA
CreateMutexA
ExitProcess
GetCurrentProcessId
GetLastError
lstrcpynA
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
GetProcessHeap
FreeLibrary
LoadLibraryExA
VirtualAlloc
SetPriorityClass
GetStringTypeA
LCMapStringW
SetThreadPriority
GetVersionExA
GetTickCount
GetTempFileNameA
Sleep
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
user32
wsprintfA
advapi32
RegCreateKeyA
RegQueryValueExA
RegCloseKey
RegSetValueExA
ws2_32
connect
ioctlsocket
socket
sendto
htonl
htons
setsockopt
WSASocketA
WSAGetLastError
send
inet_ntoa
WSAStartup
getsockopt
shutdown
ntohs
accept
bind
select
recv
closesocket
inet_addr
gethostbyname
__WSAFDIsSet
ntdll
RtlUnwind
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ