Static task
static1
Behavioral task
behavioral1
Sample
5b8fa2f4b0cf909670a40299985418f8_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5b8fa2f4b0cf909670a40299985418f8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5b8fa2f4b0cf909670a40299985418f8_JaffaCakes118
-
Size
45KB
-
MD5
5b8fa2f4b0cf909670a40299985418f8
-
SHA1
8d4d788e6e568d7d6303783916fc6876f3cadcde
-
SHA256
7683cc62595a3a273e05aa87e83075908722beb1d63d653e86304e549e6ea36d
-
SHA512
aba746b1e01adc6f4a7bfefb7c9f273baec5288f229cca9bad1236c767622577799d23fb2071d35cca8aa4d46b1e590f08cb990356fb6a02433764f00cedf80d
-
SSDEEP
768:q2uo13WGRqzYIXUwzpHBJGlXyMuBqipHzw0sGnvcoSVuJI1Sapi1vkjJE0uS:q3oKznXU0bGlzuvVwJlJH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b8fa2f4b0cf909670a40299985418f8_JaffaCakes118
Files
-
5b8fa2f4b0cf909670a40299985418f8_JaffaCakes118.exe windows:4 windows x86 arch:x86
318f17cfa1737219adb2b6e07d15a662
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
WSAAsyncGetHostByAddr
recvfrom
accept
WSACleanup
ntohs
htons
WSAStartup
WSACancelAsyncRequest
ioctlsocket
WSAAsyncGetHostByName
ntohl
closesocket
socket
setsockopt
bind
WSAGetLastError
listen
WSAAsyncSelect
comctl32
ord17
kernel32
CloseHandle
GetCurrentDirectoryA
lstrcpynA
DeleteFileA
GlobalUnlock
GlobalLock
GlobalAlloc
GetStartupInfoA
ReadFile
CreateFileA
WriteFile
GetModuleFileNameA
GetWindowsDirectoryA
MultiByteToWideChar
GetFileAttributesA
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleHandleA
GlobalFree
lstrcpyA
lstrlenA
GlobalDeleteAtom
WinExec
GlobalAddAtomA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
user32
FreeDDElParam
UnpackDDElParam
CreateWindowExA
CreateDialogParamA
DestroyWindow
PostQuitMessage
DefWindowProcA
GetDlgItemInt
SetDlgItemTextA
GetDlgItemTextA
IsWindow
EndPaint
GetDC
KillTimer
ShowWindow
EnableWindow
LoadIconA
SendMessageA
PostMessageA
SetWindowTextA
GetDlgItem
LoadImageA
EndDialog
ReleaseDC
BeginPaint
wsprintfA
DialogBoxParamA
IsWindowVisible
UnregisterClassA
GetClassInfoExA
EmptyClipboard
MessageBoxIndirectA
OpenClipboard
MessageBeep
SetClipboardData
CloseClipboard
SendDlgItemMessageA
SetFocus
DestroyIcon
SetTimer
RegisterClassExA
gdi32
SetBkColor
CreateFontIndirectA
DeleteDC
StretchBlt
RealizePalette
DeleteObject
SetTextColor
CreateCompatibleDC
CreateHalftonePalette
CreatePalette
GetDIBColorTable
GetObjectA
SelectPalette
SelectObject
CreateSolidBrush
comdlg32
GetOpenFileNameA
advapi32
GetUserNameA
shell32
FindExecutableA
Shell_NotifyIconA
ole32
CoUninitialize
CoInitialize
CoCreateInstance
winmm
PlaySoundA
msvcrt
__setusermatherr
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
strncpy
_adjust_fdiv
__p__commode
atoi
__p__fmode
__set_app_type
_except_handler3
_controlfp
localtime
??2@YAPAXI@Z
_makepath
clock
vsprintf
free
time
_splitpath
tmpnam
malloc
??3@YAXPAX@Z
_close
_open
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ