Static task
static1
Behavioral task
behavioral1
Sample
404f6c1c6188ab386c48b800c1c1106b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
404f6c1c6188ab386c48b800c1c1106b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
404f6c1c6188ab386c48b800c1c1106b_JaffaCakes118
-
Size
259KB
-
MD5
404f6c1c6188ab386c48b800c1c1106b
-
SHA1
6d870f4f367f440a9d241184cdc0b00711b7dcdc
-
SHA256
1d30201fe4d09aee60c9364f0e5edaff46dfb6823da94b0e3887c7afe7413810
-
SHA512
e3eaad47e5fa107359ac33442317507043e4b9ac1d39686162e4e63dd8d94d58358f180c22d2072611e8f0d67fcc374f4653fd9d1c00e75077ffaf486e49d20e
-
SSDEEP
6144:d6sLroZp1rpq8SqIgyt9xAqPTEyMbZgpu87GE7ifK+:dBroiKI/fpTEZg02Wj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 404f6c1c6188ab386c48b800c1c1106b_JaffaCakes118
Files
-
404f6c1c6188ab386c48b800c1c1106b_JaffaCakes118.exe windows:4 windows x86 arch:x86
6aab68ac1399d8e9fba0f351ef5fa357
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
gethostbyname
ntohs
WSAGetLastError
WSAStartup
WSACleanup
gethostbyaddr
inet_ntoa
inet_addr
iphlpapi
SendARP
kernel32
lstrlenW
lstrlenA
SystemTimeToFileTime
GetLocalTime
CreateEventA
WaitForSingleObject
GetExitCodeThread
WaitForMultipleObjects
FreeLibrary
OpenMutexA
GetCurrentThreadId
CreateSemaphoreA
OpenEventA
OpenSemaphoreA
GetModuleHandleA
FileTimeToSystemTime
GetSystemTime
FindResourceA
LoadResource
RaiseException
GetThreadLocale
GetACP
GetProcessHeap
CreateMutexA
lstrcmpA
GetProcAddress
advapi32
CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
RegCreateKeyExA
RegSetValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGetProvParam
CryptDeriveKey
CryptGetHashParam
ole32
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysStringByteLen
VariantInit
VarBstrCmp
SysStringLen
SysFreeString
SysAllocString
VariantClear
quartz
AMGetErrorTextW
DllCanUnloadNow
DllUnregisterServer
DBToAmpFactor
DllGetClassObject
AMGetErrorTextA
wship6
WSHGetSocketInformation
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VI Size: 1024B - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ep Size: 2KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.IG Size: 101KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SJWMGu Size: 4KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zTqxuS Size: 5KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qwsfZ Size: 113KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.T Size: 1024B - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ