Static task
static1
Behavioral task
behavioral1
Sample
5bb2cb863f10eb76d0acae0c54831db8_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5bb2cb863f10eb76d0acae0c54831db8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5bb2cb863f10eb76d0acae0c54831db8_JaffaCakes118
-
Size
50KB
-
MD5
5bb2cb863f10eb76d0acae0c54831db8
-
SHA1
d7d3125fe4aa51a142b1ced00e852f9f8e6973d7
-
SHA256
41f4ad803c65f093f7193d1b3f57a01529dff1a47d5a8f82d59f5b3a35529782
-
SHA512
e6e8b7dd2ef34c00d6e033877665db2046aed440181d156edfa1f5295ecd295bd92c98a3e91e297a9c7062302bfbaa9ffe985970e5a335e754782938d2e6e367
-
SSDEEP
1536:zVX+c2mALu+eBa2ld/XHKF3FMFGFzkCh42q8q:zV2SBtld/XHKF3FMFGFz1O8q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5bb2cb863f10eb76d0acae0c54831db8_JaffaCakes118
Files
-
5bb2cb863f10eb76d0acae0c54831db8_JaffaCakes118.exe windows:1 windows x86 arch:x86
5898d8b74a596cff3f24b0fca836a5fa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetFolderPathA
ShellExecuteEx
ws2_32
htons
gethostname
gethostbyname
connect
closesocket
WSAStartup
WSACleanup
send
socket
WSAIoctl
advapi32
RegEnumKeyExA
StartServiceA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
OpenSCManagerA
OpenProcessToken
LookupPrivilegeValueA
GetUserNameA
DeleteService
CreateServiceA
CloseServiceHandle
AdjustTokenPrivileges
crypt32
CryptUnprotectData
gdi32
GetDeviceCaps
kernel32
Sleep
SetProcessPriorityBoost
WideCharToMultiByte
UnmapViewOfFile
lstrlenW
CloseHandle
lstrlen
lstrcpyn
lstrcpy
lstrcmpi
lstrcmp
lstrcat
SetPriorityClass
SetErrorMode
OpenProcess
MultiByteToWideChar
MapViewOfFile
LocalFree
LocalAlloc
LoadLibraryA
GlobalMemoryStatus
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetTickCount
GetTempPathA
GetSystemDirectoryA
GetShortPathNameA
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetModuleFileNameA
GetLogicalDrives
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceA
GetCurrentProcess
GetCurrentDirectoryA
GetComputerNameA
FindNextFileA
FindFirstFileA
FindClose
ExpandEnvironmentStringsA
ExitProcess
DeleteFileA
CreateThread
CreateFileMappingA
CreateFileA
CopyFileA
WriteFile
ole32
CreateStreamOnHGlobal
CoTaskMemFree
psapi
GetModuleFileNameExA
EnumProcesses
EnumProcessModules
rasapi32
RasGetEntryPropertiesA
RasGetEntryDialParamsA
RasEnumEntriesA
shlwapi
StrChrA
PathFileExistsA
StrStrIA
StrRChrA
StrCmpNA
user32
GetDlgCtrlID
ReleaseDC
GetDC
FindWindowExA
SetActiveWindow
wsprintfA
FindWindowA
SendMessageA
wininet
InternetGetConnectedState
Sections
.text Size: 32KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
asshold Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ