Static task
static1
Behavioral task
behavioral1
Sample
4740053ed8d13f4a7459e42ebe28c1f5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4740053ed8d13f4a7459e42ebe28c1f5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4740053ed8d13f4a7459e42ebe28c1f5_JaffaCakes118
-
Size
188KB
-
MD5
4740053ed8d13f4a7459e42ebe28c1f5
-
SHA1
89f70a9daf2c43e698e345d46f60e04913e1b5cc
-
SHA256
7be54930c971f531f57f544b17e31f6b2f5ed8f23dab2c9a549db937da209905
-
SHA512
419c85635f75280b6b1b4e686f7a781acca8a5f985038ba1e25f3b9d110d5fcb113f99ba309d1f6a0082c26951066c758792761e0b0a1f52732e2bfd7b63f691
-
SSDEEP
3072:McwQqXvksXzjTrYyQoXeia9QSe1IMQ7FVGFZf0dbpoJFAO6nyWrzed0:/qXpXjrYyQxia9QSe1IMQ6FZupoDon1J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4740053ed8d13f4a7459e42ebe28c1f5_JaffaCakes118
Files
-
4740053ed8d13f4a7459e42ebe28c1f5_JaffaCakes118.exe windows:5 windows x86 arch:x86
09d57fc2c048de599d3e6d5df3595268
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
iswalpha
iswdigit
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
wprintf
__setusermatherr
wcschr
wcslen
_vsnwprintf
??1exception@@UAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
wcstoul
_ftol
wcscpy
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_ltow
wcscat
_snwprintf
?what@exception@@UBEPBDXZ
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
iswspace
?terminate@@YAXXZ
_except_handler3
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_CxxThrowException
_initterm
??1type_info@@UAE@XZ
_controlfp
_wcsicmp
msvcp60
??1bad_alloc@std@@UAE@XZ
advapi32
OpenSCManagerW
ControlService
RegCloseKey
CloseServiceHandle
RegSetValueExW
RegOpenKeyW
RegConnectRegistryW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
OpenServiceW
kernel32
MultiByteToWideChar
LoadLibraryW
GetProcAddress
FreeLibrary
GetTimeZoneInformation
Sleep
OpenEventW
GetSystemTimeAsFileTime
InterlockedIncrement
GetStdHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
GetDateFormatW
LocalAlloc
GetTimeFormatW
LocalFree
WaitForSingleObject
CreateThread
GetModuleHandleW
CreateEventW
ExpandEnvironmentStringsW
GetCommandLineW
GetModuleHandleA
GetStartupInfoA
GetFileType
WriteFile
WideCharToMultiByte
WriteConsoleW
FormatMessageW
CloseHandle
SetEvent
ntdll
NtQuerySystemTime
user32
LoadStringW
DialogBoxParamW
EndDialog
GetDlgItem
EnableWindow
SendDlgItemMessageW
wsprintfW
CharUpperW
ws2_32
connect
closesocket
recv
WSAEventSelect
WSACleanup
WSAStartup
WSALookupServiceBeginW
WSALookupServiceNextW
WSAGetLastError
WSALookupServiceEnd
socket
send
gethostbyaddr
netapi32
DsGetDcNameW
NetServerEnum
NetApiBufferFree
w32time
W32TimeQueryNTPProviderStatus
W32TimeGetNetlogonServiceBits
W32TimeSyncNow
icmp
IcmpCreateFile
IcmpSendEcho
IcmpCloseHandle
ntdsapi
DsFreeDomainControllerInfoW
DsUnBindW
DsGetDomainControllerInfoW
DsBindW
shell32
CommandLineToArgvW
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 75KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 57KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE