Static task
static1
Behavioral task
behavioral1
Sample
5d399bc322f4482c184909de891842eb_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5d399bc322f4482c184909de891842eb_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5d399bc322f4482c184909de891842eb_JaffaCakes118
-
Size
266KB
-
MD5
5d399bc322f4482c184909de891842eb
-
SHA1
6f11f64061556c170f7634bf8c61615a716f62fc
-
SHA256
900986d6cd942f9f793388e0a9326eb498353f58dcc246bb69e75928efd39404
-
SHA512
e8af9611aa34eb761c1f29926e49b125a7ecb54c5ab4a6766c9fba4b77a5e4bcb2722ab32c4f892c083b96dd2aa0c68aec93d9c097751559aa6ee5da1589ccbf
-
SSDEEP
6144:WGl75MNTwpRAO02kWWIkFFNyL90lKKhjgcDRznAqnlC:7l75MwRd0KGF+2gSdAglC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d399bc322f4482c184909de891842eb_JaffaCakes118
Files
-
5d399bc322f4482c184909de891842eb_JaffaCakes118.exe windows:4 windows x86 arch:x86
02856246266695b606cad3a06af2d7cb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
WSAGetLastError
WSACreateEvent
WSACloseEvent
socket
closesocket
gethostbyname
ntohs
send
recv
shutdown
connect
WSAEnumNetworkEvents
WSAAccept
htonl
htons
bind
listen
WSAEventSelect
inet_addr
gethostname
WSAStartup
urlmon
FindMimeFromData
kernel32
WaitForMultipleObjects
lstrlenW
lstrcpynW
CreateDirectoryW
WaitForSingleObject
LocalFree
CreateEventW
lstrcpyW
OpenEventW
CreateMutexW
GetModuleHandleW
GetTempPathW
GetTimeFormatW
GetDateFormatW
GetLocalTime
FreeLibrary
TlsAlloc
GetProcessHeap
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
GetProcAddress
advapi32
ConvertStringSidToSidW
CreateProcessAsUserW
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
ControlService
DeleteService
CreateServiceW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegConnectRegistryW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceW
QueryServiceStatus
LookupPrivilegeValueW
AdjustTokenPrivileges
GetSecurityInfo
GetSecurityDescriptorDacl
GetUserNameW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetSecurityInfo
DuplicateTokenEx
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenProcessToken
GetTokenInformation
LookupAccountSidW
SetTokenInformation
ole32
CoCreateInstance
CoInitialize
CoUninitialize
user32
wsprintfW
quartz
AMGetErrorTextW
DllUnregisterServer
kbdpl
KbdLayerDescriptor
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.oxof Size: 4KB - Virtual size: 874KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.P Size: 4KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zRSiO Size: 1024B - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.m Size: 98KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.KboI Size: 1024B - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.QWfT Size: 1024B - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hHWMk Size: 5KB - Virtual size: 555KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VRSfVp Size: 119KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uey Size: 2KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ