Static task
static1
Behavioral task
behavioral1
Sample
410566e0b7f6d9b9d30937623275ea99_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
410566e0b7f6d9b9d30937623275ea99_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
410566e0b7f6d9b9d30937623275ea99_JaffaCakes118
-
Size
74KB
-
MD5
410566e0b7f6d9b9d30937623275ea99
-
SHA1
f73c57d19af5a415770b8c05f47c83d8105e9371
-
SHA256
5ac49b6cd810245354f948053cd43e06d2484416afa67ae1de5be2691c46543f
-
SHA512
0c2bf3a3eee918619d87ce927d6e3fecef4cac64f32162bf132f3b5fffabc956c26d7d6d1e60b451485eadf4003241a4a236cb2c1842a647347544197e45e673
-
SSDEEP
768:YuArqJ+tpRE+LDCAvhNErM8Hq8Ut4POtKOBRQn2CvqK:UrG+tp6AC09KyRe2BK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 410566e0b7f6d9b9d30937623275ea99_JaffaCakes118
Files
-
410566e0b7f6d9b9d30937623275ea99_JaffaCakes118.exe windows:1 windows x86 arch:x86
81182d2ca21b46573686d79cca3474d7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExpandEnvironmentStringsA
FreeLibrary
GetCommandLineA
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersionExA
GlobalMemoryStatus
CopyFileA
LoadLibraryA
Process32First
Process32Next
CreateFileA
RtlUnwind
Sleep
TerminateThread
CreateProcessA
WriteFile
CreateThread
CreateToolhelp32Snapshot
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegSetValueExA
crtdll
__GetMainArgs
atoi
exit
free
malloc
memset
raise
rand
signal
sprintf
srand
strcat
strchr
strcmp
strlen
strncmp
strncpy
strstr
strtok
shell32
ShellExecuteA
wininet
InternetCloseHandle
InternetGetConnectedState
InternetOpenA
InternetOpenUrlA
InternetReadFile
wsock32
WSAAsyncSelect
WSACleanup
WSAStartup
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getsockname
htons
inet_addr
inet_ntoa
listen
ntohs
recv
send
sendto
socket
Sections
code Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE