Static task
static1
Behavioral task
behavioral1
Sample
65f85e6844beabeec721fdcd94d8dc81_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
65f85e6844beabeec721fdcd94d8dc81_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
65f85e6844beabeec721fdcd94d8dc81_JaffaCakes118
-
Size
64KB
-
MD5
65f85e6844beabeec721fdcd94d8dc81
-
SHA1
88e4f35379fd5ae34a9ab1f81f613def9aa016a9
-
SHA256
e383b2299b8e85186cfe6eb8c4c1775a5db0440d2e79eba7f7569fe16683336a
-
SHA512
bdada65d77501eb0681dd363f179b8625ca0c2d4358c6e8615b9af011dd3a7c2bbd6dcc0da4ef888b72426dd7031e108c2b23431b6fc12dc58dad89d6635919d
-
SSDEEP
768:RZPeAuUjMr8DEoJyUYuBZ+i/+7fBzSvjYYQOLZRR1WnKjHyYABLgPoC:RRecj9yUYsZ+i/+7ftedRRH82oC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65f85e6844beabeec721fdcd94d8dc81_JaffaCakes118
Files
-
65f85e6844beabeec721fdcd94d8dc81_JaffaCakes118.exe windows:4 windows x86 arch:x86
ab660ab1e72023a2bf1445a09bb5fd9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventA
FreeLibrary
GetCurrentProcessId
GetProcAddress
LoadLibraryA
OpenProcess
GetCurrentProcess
VirtualFreeEx
CreateRemoteThread
WriteProcessMemory
VirtualProtectEx
GetSystemDirectoryA
DisconnectNamedPipe
TerminateProcess
WaitForMultipleObjects
TerminateThread
DuplicateHandle
GetTickCount
HeapAlloc
GetProcessHeap
WinExec
GetCommandLineA
GetModuleFileNameA
lstrcatA
CopyFileA
GetLastError
ExitProcess
GetVersion
CloseHandle
ExitThread
CreatePipe
GetStartupInfoA
CreateProcessA
Sleep
WriteFile
PeekNamedPipe
ReadFile
VirtualAllocEx
CreateThread
SetStdHandle
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
FlushFileBuffers
SetFilePointer
RaiseException
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
HeapFree
RtlUnwind
GetModuleHandleA
HeapReAlloc
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegCloseKey
RegSetValueExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenProcessToken
ws2_32
ntohs
WSASocketA
sendto
recvfrom
WSAGetLastError
WSACleanup
setsockopt
inet_addr
connect
WSAStartup
socket
htons
bind
listen
accept
send
recv
closesocket
select
__WSAFDIsSet
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE