Static task
static1
Behavioral task
behavioral1
Sample
5ce00b76f90a79f967f8b78ea0023837_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5ce00b76f90a79f967f8b78ea0023837_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5ce00b76f90a79f967f8b78ea0023837_JaffaCakes118
-
Size
25KB
-
MD5
5ce00b76f90a79f967f8b78ea0023837
-
SHA1
ffb5d612c74b9eecbeed756ced962987952582de
-
SHA256
48fe66b416aba0c9632b3bedc97abc5c41025a869b474d026491ac40fcc3ec42
-
SHA512
2d58bbc5645b40a51e13828394129c4af2c96c6953e489bc50953fef1d59270a7a8e3036704f58f2143bf5f3f7d94027c05df63be7800184c79fad11d9daa2f9
-
SSDEEP
384:vUNEQqPBwcGoMIToiBVKU3ky2+fY/1jb1Z1FqJQsgDGOjkzq1s4RM1VoOOu/:GqxGSTDKAYJfBnG0FHRiH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ce00b76f90a79f967f8b78ea0023837_JaffaCakes118
Files
-
5ce00b76f90a79f967f8b78ea0023837_JaffaCakes118.exe windows:4 windows x86 arch:x86
915d3564cd81ab94bebb28676fba8295
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetCurrentProcess
CreateProcessA
lstrcpyA
lstrlenA
WinExec
GetProcAddress
LoadLibraryA
GetTempPathA
TerminateProcess
Sleep
CreateThread
SetLastError
MoveFileExA
DeleteFileA
SetFileAttributesA
GetLastError
ExitProcess
ReleaseMutex
OpenMutexA
SetThreadPriority
GetCurrentThread
SetPriorityClass
lstrcatA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
WaitForSingleObject
CreateMutexA
CopyFileA
GetSystemDirectoryA
GlobalMemoryStatusEx
GetComputerNameA
GetLocaleInfoW
GetStartupInfoA
VirtualAlloc
VirtualAllocEx
VirtualProtectEx
GetModuleHandleA
WriteProcessMemory
SetThreadContext
ResumeThread
GetThreadContext
ReadProcessMemory
VirtualQueryEx
ExitThread
GetTickCount
RaiseException
InterlockedExchange
FreeLibrary
LocalAlloc
shell32
ShellExecuteExA
ws2_32
gethostbyname
inet_ntoa
WSAStartup
select
__WSAFDIsSet
gethostname
htons
socket
connect
shutdown
closesocket
send
recv
inet_addr
sendto
setsockopt
WSASocketA
htonl
msvcrt
strlen
strcat
memcpy
atoi
strcpy
strncpy
strcspn
__CxxFrameHandler
_CxxThrowException
exit
strncmp
_except_handler3
rand
sprintf
malloc
??2@YAPAXI@Z
fread
ftell
fseek
fclose
fopen
??3@YAXPAX@Z
??1type_info@@UAE@XZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strstr
memset
Sections
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ