Static task
static1
Behavioral task
behavioral1
Sample
5b844f9dc9de6f8f128ebdb0bb134911_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5b844f9dc9de6f8f128ebdb0bb134911_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5b844f9dc9de6f8f128ebdb0bb134911_JaffaCakes118
-
Size
1.6MB
-
MD5
5b844f9dc9de6f8f128ebdb0bb134911
-
SHA1
f40518117a8690414c187c3595b65d58d299b78c
-
SHA256
11d06f082f7aac217f339d797c13df959fea02d616441e796529de3bee51dbc9
-
SHA512
2de9e5a07dbbe61eb833a6a25bc87048ce220c3cc1b3e80e43f31216e960139b0681020fc1e881addbd5d5a6157d02923c6a8adae026befaee7165e8cb19eb23
-
SSDEEP
24576:i1EITQQyuuAYXMB03A4ZK605+TSjOA34P9Y6omE:tITcuuAaMB03TZK605+ejOAIP9Y6omE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b844f9dc9de6f8f128ebdb0bb134911_JaffaCakes118
Files
-
5b844f9dc9de6f8f128ebdb0bb134911_JaffaCakes118.exe windows:4 windows x86 arch:x86
aae80fd8fe3fec29104c2f5e9bbf9762
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
kernel32
AddAtomA
CloseHandle
CopyFileA
CreateFileA
CreateMutexA
CreateSemaphoreA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FindAtomA
GetAtomNameA
GetCurrentProcess
GetCurrentProcessId
GetFileSize
GetLastError
GetModuleFileNameA
GetSystemDirectoryA
GetSystemInfo
GetTickCount
GetWindowsDirectoryA
Module32First
MoveFileExA
OpenProcess
Process32First
Process32Next
ReadFile
ReadProcessMemory
ReleaseMutex
ReleaseSemaphore
SetUnhandledExceptionFilter
Sleep
TerminateProcess
VirtualAlloc
VirtualFree
VirtualQueryEx
WaitForMultipleObjects
WaitForSingleObject
WriteProcessMemory
msvcrt
__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_errno
_iob
_onexit
_setmode
_vsnprintf
abort
atexit
atoi
calloc
exit
fclose
fopen
fprintf
free
fscanf
gmtime
malloc
memcmp
memcpy
memmove
memset
printf
rand
realloc
signal
srand
sscanf
strcat
strchr
strcmp
strcpy
strlen
strncmp
strstr
strtok
time
toupper
ws2_32
WSACleanup
WSAGetLastError
WSAStartup
accept
bind
closesocket
connect
htonl
htons
inet_ntoa
listen
ntohl
ntohs
recv
recvfrom
send
sendto
setsockopt
shutdown
socket
Sections
.text Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 14KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stab Size: 238KB - Virtual size: 237KB
IMAGE_SCN_MEM_DISCARDABLE
.stabstr Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_MEM_DISCARDABLE