Static task
static1
Behavioral task
behavioral1
Sample
6f7340cacac9cc29591e96b987d9d962_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6f7340cacac9cc29591e96b987d9d962_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6f7340cacac9cc29591e96b987d9d962_JaffaCakes118
-
Size
200KB
-
MD5
6f7340cacac9cc29591e96b987d9d962
-
SHA1
1256d901bfa66775bf96b73a0d3c7dc9ab34532e
-
SHA256
35da761e1bf2541be1b3049ebef891e1f11c32bcc170cd0d7501e1c07a2c2b53
-
SHA512
59ad0187d6a8317c2d28afd81748e49dc4d9a2b080dd9bbc7f78e89527afcd0cf5e895f4b957d04b958c235931eb1dc763d42a1d0a2b9efa242a3703953b5316
-
SSDEEP
3072:+54FoD11oJmeDmBqskJ9K1uo++t/cugTbC2R9cYc0ujTwxxNMu4QO:+ioI8eRl+9cRR/VujgM/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6f7340cacac9cc29591e96b987d9d962_JaffaCakes118
Files
-
6f7340cacac9cc29591e96b987d9d962_JaffaCakes118.exe windows:4 windows x86 arch:x86
c488a7c49e9ad45ccf82271a3eab41f0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateThread
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GetExitCodeThread
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
lstrlenA
OpenProcess
GetProcAddress
GetModuleHandleA
GetPrivateProfileStringA
CreateThread
LoadLibraryA
WinExec
GetLastError
CreateMutexA
GetCurrentProcess
SystemTimeToFileTime
GetLocalTime
GetProcessTimes
VirtualFreeEx
LCMapStringA
SetEndOfFile
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
FlushFileBuffers
SetStdHandle
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
Sleep
FindResourceA
LoadResource
SizeofResource
CreateFileA
SetFilePointer
GetFileSize
WriteFile
ReadFile
CloseHandle
TerminateProcess
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
HeapFree
HeapAlloc
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
RtlUnwind
LCMapStringW
user32
GetMessageA
LoadAcceleratorsA
LoadStringA
RegisterClassExA
TranslateAcceleratorA
LoadIconA
CreateWindowExA
PostQuitMessage
EndPaint
DrawTextA
TranslateMessage
DispatchMessageA
LoadCursorA
EndDialog
DefWindowProcA
DestroyWindow
DialogBoxParamA
BeginPaint
GetClientRect
advapi32
RegQueryValueExA
RegCreateKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
shell32
ShellExecuteA
StrStrIA
wininet
HttpQueryInfoA
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
ws2_32
WSACleanup
WSAStartup
inet_ntoa
gethostbyname
inet_addr
iphlpapi
SendARP
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 144KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ