Static task
static1
Behavioral task
behavioral1
Sample
476be010379001724218f7af10b9bf2b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
476be010379001724218f7af10b9bf2b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
476be010379001724218f7af10b9bf2b_JaffaCakes118
-
Size
256KB
-
MD5
476be010379001724218f7af10b9bf2b
-
SHA1
5ed4c2456dee15a618d8c39c7167a6707438b4ef
-
SHA256
c0f59d278819058842dabe34d631a8566c6cd6754ab975940d09228bfba6823a
-
SHA512
a0bd7c10a74e7c19f9d4eba9fbc7c20a174c485e360e1b04a17dabab884bd3a050f479cb5edb756b2b9fe57b7296eb32cdbe3736a401ea45ac9de5e82b42661f
-
SSDEEP
6144:+5JsJ+LTvefonj44IEyFBInpCV62ayxr5ORdTE1dUI+W+q5:+5V/veQnj3zg61yd5wbI+8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 476be010379001724218f7af10b9bf2b_JaffaCakes118
Files
-
476be010379001724218f7af10b9bf2b_JaffaCakes118.exe windows:4 windows x86 arch:x86
fa3f5739f6c86b6aaea16480b458a142
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVolumeInformationA
GetComputerNameA
TerminateProcess
OutputDebugStringA
GetLastError
CreateMutexA
DeleteFileA
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceExA
OpenFile
WaitForSingleObject
CreateThread
GetModuleFileNameA
FindClose
FindNextFileA
FindFirstFileA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetEndOfFile
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
CreateProcessA
Sleep
GetLocalTime
lstrlenA
CreateFileA
FlushFileBuffers
SetStdHandle
SetFilePointer
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
SetEnvironmentVariableA
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetProcAddress
GetCurrentProcess
HeapFree
HeapAlloc
HeapReAlloc
GetTimeZoneInformation
GetSystemTime
GetFileAttributesA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
CloseHandle
WriteFile
ReadFile
WideCharToMultiByte
user32
EnumChildWindows
GetWindowThreadProcessId
GetClassNameA
GetParent
CloseDesktop
SetForegroundWindow
EnumDesktopWindows
PostMessageA
CreateDesktopA
OpenDesktopA
SendMessageA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
shell32
SHGetSpecialFolderPathA
ws2_32
WSAGetLastError
WSAStartup
connect
setsockopt
socket
htons
send
recv
closesocket
shutdown
gethostbyname
WSACleanup
inet_addr
Sections
.text Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 172KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ