Static task
static1
Behavioral task
behavioral1
Sample
416ce7c97f6eebfe076e40c602f36ed5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
416ce7c97f6eebfe076e40c602f36ed5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
416ce7c97f6eebfe076e40c602f36ed5_JaffaCakes118
-
Size
44KB
-
MD5
416ce7c97f6eebfe076e40c602f36ed5
-
SHA1
01b58e1d3dc2f010d297e7ab8296f2646c8ea3d3
-
SHA256
062548842e4344354dee1b8321b25614551358dfe097d5d0c21ea6bbef79aca6
-
SHA512
146aeb36f523516ec9e838f36056761bc92fe0131884cc85590bb29adbe68e8d8d2db15c31af84df2b75e40ba1325260694c7ee6336fa40108108553df668b00
-
SSDEEP
768:KnsyUhAQuy7XdLXTcWvpXk1VbHOmCuwJpWgswXvH0r+hqo9ZcxPDfM:KShAQuy7XhQWvpXk1hdg2eMr+hqo9ZcR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 416ce7c97f6eebfe076e40c602f36ed5_JaffaCakes118
Files
-
416ce7c97f6eebfe076e40c602f36ed5_JaffaCakes118.exe windows:4 windows x86 arch:x86
befdf9d5dea4d8072560ae554cbc4222
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCloseKey
RegEnumKeyA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
kernel32
AddAtomA
CloseHandle
CreateMutexA
EnterCriticalSection
ExitProcess
FindAtomA
GetAtomNameA
GetLastError
InitializeCriticalSection
LeaveCriticalSection
ReleaseMutex
SetUnhandledExceptionFilter
Sleep
msvcrt
_getpid
_strdup
_stricmp
_unlink
__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_beginthread
_cexit
_endthread
_iob
_onexit
_setmode
_stricmp
abort
atexit
calloc
fclose
fgetc
fopen
fputc
fread
free
fseek
ftell
fwrite
getenv
gmtime
isspace
malloc
memcmp
memcpy
memmove
memset
printf
rand
realloc
signal
sprintf
srand
strchr
strcmp
strcpy
strftime
strlen
strncmp
strncpy
strrchr
strstr
strtoul
time
tolower
toupper
vsprintf
shell32
ShellExecuteA
wsock32
WSAGetLastError
WSAStartup
accept
bind
closesocket
connect
getsockopt
htons
inet_addr
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Sections
.text Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 304B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE