Static task
static1
Behavioral task
behavioral1
Sample
70bb6e7857d281e8ac3933bd4e85c701_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
70bb6e7857d281e8ac3933bd4e85c701_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
70bb6e7857d281e8ac3933bd4e85c701_JaffaCakes118
-
Size
76KB
-
MD5
70bb6e7857d281e8ac3933bd4e85c701
-
SHA1
32a24b61cbf88f72bc5da42691bb32567221e12d
-
SHA256
0106f25ab5493d43c8e7d0b9c2be3fa7abfdc509ee5e526824aad86ed168759b
-
SHA512
f5af2a1c27088ab8a2ca5f2404d5ad9d7a68d484b957eb667384c3ac91f6653531ca07cc24f9b4ddd1053c6bd068473e39ba5f4ac0d983cd20e4e0a41d47e13c
-
SSDEEP
1536:seXHbXwf8PBk3WbjxV5DUxp3BDdcgrNior:vHrweXDUTNdcg1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70bb6e7857d281e8ac3933bd4e85c701_JaffaCakes118
Files
-
70bb6e7857d281e8ac3933bd4e85c701_JaffaCakes118.exe windows:4 windows x86 arch:x86
e3100217cbbf39663f69fc778518fcb7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord354
ord665
ord5186
ord6385
ord1979
ord537
ord2915
ord535
ord3522
ord858
ord3521
ord6402
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord3401
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord3953
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord800
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord815
ord825
ord823
ord540
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
__dllonexit
srand
rand
fwrite
_wcsicmp
memcmp
tmpnam
fgetc
memcpy
div
_unlink
__CxxFrameHandler
??1type_info@@UAE@XZ
_CxxThrowException
_ltoa
_wcsupr
strstr
strcpy
_strdup
strcat
free
memset
fclose
fprintf
fopen
_splitpath
_strupr
_strcmpi
exit
malloc
wcsncpy
wcsncmp
wcscat
wcscpy
_strlwr
_mbsrchr
sprintf
_except_handler3
wcslen
strlen
kernel32
OpenProcess
GetProcessHeap
HeapAlloc
HeapFree
WideCharToMultiByte
GetFileSize
GetVersionExA
GetWindowsDirectoryA
CreateFileA
GetFileTime
CloseHandle
SetFileTime
GetSystemDirectoryA
GetLastError
CreateThread
GetSystemDefaultLCID
TerminateProcess
MultiByteToWideChar
MoveFileW
ReadFile
CreateFileW
DuplicateHandle
VirtualAlloc
VirtualFree
CompareStringW
GetSystemDirectoryW
lstrcatA
lstrcpyA
lstrcpynA
lstrcmpA
InterlockedIncrement
InterlockedDecrement
GetExitCodeProcess
Sleep
SetLastError
CreateProcessA
GetCurrentProcess
GetWindowsDirectoryW
GetCurrentProcessId
GetProcAddress
LoadLibraryA
CopyFileA
CreateMutexA
GetModuleFileNameA
FreeResource
WriteFile
LockResource
DeleteFileA
LoadResource
SizeofResource
FindResourceA
GetModuleHandleA
GetShortPathNameA
GetVersion
lstrlenA
GetTickCount
GetStartupInfoA
GetCurrentThreadId
GetVolumeInformationA
LocalAlloc
LocalFree
GetLocalTime
GetLocaleInfoA
user32
IsCharAlphaNumericA
GetDC
ShowWindow
FindWindowExA
GetWindowTextA
EnumWindows
DispatchMessageA
TranslateMessage
GetMessageA
wsprintfW
wsprintfA
ReleaseDC
GetSystemMetrics
gdi32
CreateCompatibleBitmap
SelectObject
BitBlt
CreateCompatibleDC
DeleteObject
advapi32
RegOpenKeyExA
GetUserNameA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegEnumKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
LookupAccountSidA
GetTokenInformation
OpenProcessToken
RegEnumValueA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegSetValueExW
RegOpenKeyExW
ole32
OleInitialize
CoCreateInstance
OleUninitialize
CreateStreamOnHGlobal
oleaut32
VariantCopy
SysAllocStringLen
SysAllocString
VariantClear
VariantInit
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
GetErrorInfo
SysFreeString
ws2_32
select
__WSAFDIsSet
socket
connect
htons
accept
send
recv
WSAStartup
closesocket
ioctlsocket
wininet
FindNextUrlCacheEntryA
DeleteUrlCacheEntry
FindCloseUrlCache
FindFirstUrlCacheEntryA
gdiplus
GdipDisposeImage
GdipFree
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipSaveImageToStream
GdiplusStartup
GdiplusShutdown
GdipGetImageThumbnail
Sections
.text Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE