Static task
static1
Behavioral task
behavioral1
Sample
66e83a8feb8c12becba384df657109d0_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
66e83a8feb8c12becba384df657109d0_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
66e83a8feb8c12becba384df657109d0_JaffaCakes118
-
Size
149KB
-
MD5
66e83a8feb8c12becba384df657109d0
-
SHA1
bb111614e45ca16bb1a87a2179749e72f528689a
-
SHA256
baea3b82fdb88d4d5e4d435d10762f1d2a215a4f5638e588bb31b5de1afe2023
-
SHA512
a9a6a8fcfa877016e1481e519add5b59af248012fefcdc192c9e4973fa3e98fda2f1f97bdb69260520d0b623a47b37391de6f6e5a64edc530e026b6283e18fb7
-
SSDEEP
3072:zF+VFmGQr8bek4IfW94o18VTb78uc4GA8zHIP4e3E2/jPRNSVe:zK1ek4qC4dbEzHIP4e3J/jPRNSVe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 66e83a8feb8c12becba384df657109d0_JaffaCakes118
Files
-
66e83a8feb8c12becba384df657109d0_JaffaCakes118.exe windows:4 windows x86 arch:x86
bb067e381eb2a5b2a319e8bb85a19c4c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFilePointer
lstrlenA
ReadFile
GetSystemTime
GetFileSize
GetCurrentProcessId
CreateThread
TerminateThread
GetDriveTypeA
GetLogicalDriveStringsA
FindClose
FindNextFileA
FindFirstFileA
HeapReAlloc
VirtualAlloc
VirtualFree
WriteFile
CreateFileA
lstrcatA
ExitThread
GetTickCount
lstrcmpiA
CreateMutexA
CloseHandle
ExitProcess
GetCurrentThread
SetThreadPriority
Sleep
GetCurrentProcess
RaiseException
GetLocalTime
lstrcpynA
GetSystemDirectoryA
CreateDirectoryA
lstrcmpA
GetComputerNameA
GetProcessTimes
CreateProcessA
GetVersionExA
GetTempFileNameA
GetTempPathA
WinExec
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetExitCodeThread
InitializeCriticalSection
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
CreateEventA
SetEvent
WaitForSingleObject
RtlUnwind
MultiByteToWideChar
LCMapStringW
LCMapStringA
WideCharToMultiByte
HeapAlloc
HeapFree
GetModuleHandleA
lstrcpyA
GetFileAttributesA
DeleteFileA
MoveFileA
LoadLibraryA
GetProcAddress
GlobalAlloc
GlobalFree
FreeLibrary
GetLastError
GetModuleFileNameA
user32
CharLowerA
wvsprintfA
wsprintfA
advapi32
InitializeAcl
RegOpenKeyExA
GetUserNameA
RegQueryValueExA
CloseEventLog
ReadEventLogA
OpenEventLogA
RegDeleteKeyA
RegSetValueExA
IsValidAcl
ControlService
ChangeServiceConfigA
OpenSCManagerA
OpenServiceA
DeleteService
CloseServiceHandle
RegCreateKeyA
RegEnumValueA
RegDeleteValueA
RegCloseKey
ole32
CoInitialize
CoUninitialize
CoCreateGuid
StringFromCLSID
CoCreateInstance
CoInitializeSecurity
oleaut32
VariantInit
VariantClear
ws2_32
gethostbyname
WSACleanup
gethostname
inet_ntoa
htons
connect
recv
getpeername
send
setsockopt
accept
socket
closesocket
select
ioctlsocket
shutdown
WSAGetLastError
bind
listen
WSAStartup
Sections
.text Size: 113KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 35KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE