Static task
static1
Behavioral task
behavioral1
Sample
6f453f369760e0ebcd6dfc4fc9da1b61_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6f453f369760e0ebcd6dfc4fc9da1b61_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6f453f369760e0ebcd6dfc4fc9da1b61_JaffaCakes118
-
Size
75KB
-
MD5
6f453f369760e0ebcd6dfc4fc9da1b61
-
SHA1
1ab861132a87721e6ad72a3ec70cb7e61ef71646
-
SHA256
c86b986e8a3429690df4551b9b828874d177414e9d12022bbbc2b3fdde9e31ab
-
SHA512
8db8bdad88b1985136c3c6a147faf4e6f87d2f9a1a40b507f00e23b9d1278d5ff5891460088fa4ac283c8b8456f448b3fe825ed05891d7d093b4f30209685278
-
SSDEEP
768:hzQkHM7f+ZwPEKBhECKdN2dhYJkby1MLGEiZvPwH7Svon/5nO4rGQzTGfqc33e:hzdH25jvby1MLGoqonOQhx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6f453f369760e0ebcd6dfc4fc9da1b61_JaffaCakes118
Files
-
6f453f369760e0ebcd6dfc4fc9da1b61_JaffaCakes118.exe windows:4 windows x86 arch:x86
21488b09d7870e3cc23b121a0f785b64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessA
CreatePipe
CopyFileA
GetSystemDirectoryA
GetTempPathA
GetStartupInfoA
DeleteFileA
WaitForSingleObject
CreateThread
GetModuleFileNameA
WriteFile
GetModuleHandleA
CloseHandle
CreateFileA
WinExec
GetExitCodeThread
TerminateThread
ReadFile
PeekNamedPipe
HeapReAlloc
HeapFree
GetCommandLineA
FlushFileBuffers
LCMapStringW
LCMapStringA
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
GetCurrentProcess
UnhandledExceptionFilter
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
Sleep
SetUnhandledExceptionFilter
SetFilePointer
RtlUnwind
GetLastError
GetVersion
ExitProcess
GetEnvironmentStringsW
HeapAlloc
TerminateProcess
GetStdHandle
SetHandleCount
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetStringTypeW
GetStringTypeA
GetFileType
HeapDestroy
HeapCreate
VirtualFree
MultiByteToWideChar
user32
LoadStringA
advapi32
RegOpenKeyExA
RegSetValueExA
RegCloseKey
ws2_32
socket
send
inet_addr
htons
WSAStartup
setsockopt
connect
recv
closesocket
WSACleanup
shlwapi
PathRemoveFileSpecA
wininet
InternetCloseHandle
InternetOpenUrlA
HttpQueryInfoA
InternetReadFile
InternetOpenA
Sections
.text Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ