Static task
static1
Behavioral task
behavioral1
Sample
714923d1bfb9bfabc5594f631fe3163d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
714923d1bfb9bfabc5594f631fe3163d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
714923d1bfb9bfabc5594f631fe3163d_JaffaCakes118
-
Size
46KB
-
MD5
714923d1bfb9bfabc5594f631fe3163d
-
SHA1
04deaf200cdd7d89f6c79a8edeff13d9a94410b2
-
SHA256
4691b4b2e189682c814a7f51194a46c4df35ba105a984768098dbda6f47c0f2d
-
SHA512
5d913bd145de47f1aca2b166a7851af73c9624abecdda6ffa784a9e2acfacad1dfb4606b507b96ac03679c0723b96c20c879f1719801c8fcf7d7f33b082a753d
-
SSDEEP
768:Yz1wV+XS+k9ylkrzLMQIjQExSO4+FDtL2lw7z3Fj9wbPk54ZJ4wA2:Yyx9mkr0G+hGYVj9wbcqZee
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 714923d1bfb9bfabc5594f631fe3163d_JaffaCakes118
Files
-
714923d1bfb9bfabc5594f631fe3163d_JaffaCakes118.exe windows:5 windows x86 arch:x86
20e41ce01f80755f4eea7fc12deb3017
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
ZwReadFile
ZwQueryInformationFile
strrchr
ZwCreateFile
ZwWriteFile
ZwQueryVolumeInformationFile
ZwQueryDirectoryFile
wcslen
ZwSetInformationFile
RtlAdjustPrivilege
RtlIpv4StringToAddressA
ZwOpenThreadTokenEx
_wcsicmp
strcmp
strcpy
sprintf
memcmp
strchr
ZwSetSecurityObject
LdrAccessResource
wcsrchr
swprintf
strlen
RtlDestroyQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlCreateQueryDebugBuffer
RtlEqualUnicodeString
ZwQuerySystemInformation
ZwSuspendThread
ZwQueryInformationThread
ZwOpenThread
_stricmp
RtlNtStatusToDosError
RtlIpv4AddressToStringA
ZwClose
ZwEnumerateKey
ZwOpenKey
ZwQueryKey
ZwResumeThread
ZwLoadDriver
ZwCreateSymbolicLinkObject
ZwUnmapViewOfSection
ZwFlushVirtualMemory
RtlImageNtHeader
ZwMapViewOfSection
ZwCreateSection
ZwFsControlFile
ZwOpenFile
ZwSetValueKey
ZwCreateKey
LdrFindResource_U
RtlInitUnicodeString
ZwAdjustPrivilegesToken
memset
RtlIpv4StringToAddressW
ZwQueryValueKey
ZwImpersonateThread
memcpy
kernel32
DeleteTimerQueueTimer
Sleep
GetVersion
ExitProcess
GetTickCount
CreateTimerQueueTimer
VirtualAlloc
GetSystemTimeAsFileTime
GetLastError
BindIoCompletionCallback
LocalFree
LocalAlloc
advapi32
MD5Update
MD5Final
MD5Init
ws2_32
WSACleanup
WSARecvFrom
WSASendTo
setsockopt
WSASend
WSARecv
WSAIoctl
bind
closesocket
WSAGetLastError
WSASocketW
WSAStartup
cabinet
ord20
ord22
ord23
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 432B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ