Static task
static1
Behavioral task
behavioral1
Sample
60d09d1b3ded89e84ba076f31d8f9bc5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
60d09d1b3ded89e84ba076f31d8f9bc5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
60d09d1b3ded89e84ba076f31d8f9bc5_JaffaCakes118
-
Size
48KB
-
MD5
60d09d1b3ded89e84ba076f31d8f9bc5
-
SHA1
8ca72863f311e9bbc1424f5d85b3d2f40892b35c
-
SHA256
e3ae6c5e225d7be87a8becbd3213887e5eb05ce1518d36e23792d7999128ef0c
-
SHA512
edbd868281bccfe88cb504bc9d42bc8bce5021461f485b3ffee6765539c29eb3f9d68d6382600d7812d75bffed8627b392bd08bbca194a7fd58f5fc7e27f8f6f
-
SSDEEP
768:Ic7ck46qM1PkG0HrloMt3RicH0wDrF5X9gFEvkk3p:dGu1k/ZoWhewDR5NVvkk3p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60d09d1b3ded89e84ba076f31d8f9bc5_JaffaCakes118
Files
-
60d09d1b3ded89e84ba076f31d8f9bc5_JaffaCakes118.exe windows:4 windows x86 arch:x86
cec2c227b9e0861ec652edd924199b35
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
CreateThread
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
GetFileSize
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
ReadFile
CloseHandle
DeleteFileA
ExitProcess
WriteFile
CreateDirectoryA
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
GetStringTypeW
RtlUnwind
WinExec
HeapReAlloc
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
HeapFree
VirtualAlloc
TerminateProcess
user32
GetWindowRect
MessageBoxA
SendMessageA
wsprintfA
EnableWindow
GetDlgItem
SetWindowPos
DialogBoxParamA
GetParent
GetDesktopWindow
OffsetRect
CopyRect
SetWindowTextA
advapi32
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegSetValueExA
wsock32
sendto
connect
socket
WSAStartup
ioctlsocket
recvfrom
htons
comctl32
InitCommonControlsEx
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ