Static task
static1
Behavioral task
behavioral1
Sample
443625bff3e1d088994b1e41ebd26844_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
443625bff3e1d088994b1e41ebd26844_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
443625bff3e1d088994b1e41ebd26844_JaffaCakes118
-
Size
164KB
-
MD5
443625bff3e1d088994b1e41ebd26844
-
SHA1
9c701f2d965853c1bd74df6922a27b268d07de0d
-
SHA256
b93f2f106ec21f6761c322792f9e318a1dfde4785fa7433f8c0519ece204aa53
-
SHA512
6aacb7c29e3e6f00045dcefe5ed6d45966a4d91dd19ec41fc363faae67deb042a96445a5d559a3cc61dcda46d20f8e3e477c74fd8e99cb7327d5762220c53e30
-
SSDEEP
1536:fgzg4qVriXPoXMEr9JIQbuq19CW5cCZPLGUobW/0:IzIVrioXl9CMjgW5tZKUoT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 443625bff3e1d088994b1e41ebd26844_JaffaCakes118
Files
-
443625bff3e1d088994b1e41ebd26844_JaffaCakes118.exe windows:4 windows x86 arch:x86
eb90fd77ac189174ac5710fe3d458653
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
LoadLibraryA
Sleep
SetFileAttributesA
CopyFileA
GetTickCount
MoveFileExA
GetDriveTypeA
CreateThread
LCMapStringW
LCMapStringA
SetUnhandledExceptionFilter
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
ReadProcessMemory
DeleteFileA
ExitProcess
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
GetOEMCP
GetACP
CompareStringW
CompareStringA
GetCPInfo
SetFilePointer
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
SetConsoleCtrlHandler
GetFileType
SetHandleCount
GetEnvironmentStringsW
RtlUnwind
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
HeapAlloc
HeapReAlloc
HeapFree
GetLastError
HeapDestroy
HeapCreate
VirtualFree
TerminateProcess
VirtualAlloc
WideCharToMultiByte
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
CloseHandle
user32
BlockInput
advapi32
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameA
RegDeleteKeyA
shell32
ShellExecuteA
ws2_32
send
inet_addr
gethostbyname
closesocket
socket
WSAGetLastError
WSACleanup
htons
connect
recv
WSAStartup
iphlpapi
GetNetworkParams
Sections
.text Size: 136KB - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ