Static task
static1
Behavioral task
behavioral1
Sample
485a0b6cef37d769d3be886062a3ee77_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
485a0b6cef37d769d3be886062a3ee77_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
485a0b6cef37d769d3be886062a3ee77_JaffaCakes118
-
Size
188KB
-
MD5
485a0b6cef37d769d3be886062a3ee77
-
SHA1
468f8c71ed6994efa0fd48a561a9a6375e697f94
-
SHA256
8c16c6cd04663523b6d16f0a4030a5ff1b69868fd5e5c3b8db042e39bad99971
-
SHA512
4d31d1873c652274fd249ef17cca90ccf5593274df3c4b9010975a6cc723053b39e10c3ce01d53fcd2f957b0cefcecae0d87cc334357620ff01725fde3526588
-
SSDEEP
3072:2uyqAtRb09rDM5hITqEIQbyxDxttRD4xCbGcJpHjDgcDIP:2uyqArb05DMMTqPhfb3JjDv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 485a0b6cef37d769d3be886062a3ee77_JaffaCakes118
Files
-
485a0b6cef37d769d3be886062a3ee77_JaffaCakes118.exe windows:4 windows x86 arch:x86
35916d4ba6dcbd16b468dba08b4cfd90
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineA
SetUnhandledExceptionFilter
ExpandEnvironmentStringsA
GetShortPathNameA
GetTickCount
CreateEventA
WaitForSingleObject
GetModuleFileNameA
LoadLibraryA
SleepEx
CreateFileA
GetCurrentThreadId
WriteFile
GetFileTime
SetFileTime
MoveFileA
GetTempPathA
GetCurrentDirectoryA
ExitProcess
GetModuleHandleA
GetCurrentProcessId
GetProcAddress
Sleep
GetCurrentThread
GetSystemDirectoryA
SetFileAttributesA
DeleteFileA
lstrlenA
GetFileAttributesA
CreateDirectoryA
GetLastError
GetCurrentProcess
CloseHandle
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
advapi32
GetServiceKeyNameA
GetServiceDisplayNameA
ControlService
CreateServiceA
RegSaveKeyA
RegRestoreKeyA
DeleteService
ChangeServiceConfig2A
OpenSCManagerA
OpenServiceA
ChangeServiceConfigA
StartServiceA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
msvcrt
_except_handler3
strcat
strcpy
memset
srand
strcmp
strncpy
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_controlfp
_strlwr
_stricmp
_ftol
rand
__CxxFrameHandler
??2@YAPAXI@Z
memcpy
strlen
_strrev
_strupr
ws2_32
listen
Sections
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ