Static task
static1
Behavioral task
behavioral1
Sample
7667136897dda167a1946e4bf2cb9926_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
7667136897dda167a1946e4bf2cb9926_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
7667136897dda167a1946e4bf2cb9926_JaffaCakes118
-
Size
39KB
-
MD5
7667136897dda167a1946e4bf2cb9926
-
SHA1
ef43d819e09e6834340685aed0a4535925d33bbb
-
SHA256
b1153d1e6e0724d97b3d8fde900a2c9389295075f7f4f64d841d18369643e5e5
-
SHA512
5d904add3b20b1f0d2b56278d57f9b570fc1fe077b2a571069fbc42f9c8c1c52a0cfbf7c50c3b87b11aafcf7423a1d9dd590bc0065f56feba642a43aeb91fffb
-
SSDEEP
768:/+/g8+UAq4OwSRNFdv7QuhQ0KTM/0V6G9kt7MVkW0SzCAI0ioqKlUHGq5RvK7p96:/t/KYBOHGORNwKKfp9Ri8H07vCq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7667136897dda167a1946e4bf2cb9926_JaffaCakes118
Files
-
7667136897dda167a1946e4bf2cb9926_JaffaCakes118.exe windows:4 windows x86 arch:x86
f48cbbb116ab1a9ee4b7e1bf66fbc553
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
fopen
fprintf
fclose
exit
toupper
_ftol
ceil
_endthread
strcmp
strncpy
_beginthread
strstr
srand
rand
_snprintf
memset
_vsnprintf
strncat
strlen
kernel32
FreeLibrary
LoadLibraryA
GetProcAddress
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
lstrcmpiA
GetLogicalDriveStringsA
WinExec
GetComputerNameA
GetLocaleInfoA
GetTickCount
TerminateThread
Sleep
WaitForSingleObject
CreateMutexA
GetCurrentProcessId
ExitProcess
GetLastError
SetFileAttributesA
CopyFileA
GetSystemDirectoryA
GetModuleFileNameA
GetModuleHandleA
SetErrorMode
GetTempPathA
QueryPerformanceFrequency
QueryPerformanceCounter
GetVersionExA
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
MoveFileExA
GetEnvironmentVariableA
GetShortPathNameA
lstrlenA
GetDriveTypeA
WriteFile
CreateFileA
CreateDirectoryA
lstrcatA
CloseHandle
user32
MessageBoxA
FindWindowA
GetWindowThreadProcessId
ws2_32
recv
gethostbyname
connect
closesocket
send
inet_addr
htons
WSAStartup
socket
urlmon
URLDownloadToFileA
shell32
ShellExecuteExA
ShellExecuteA
SHChangeNotify
advapi32
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
ntdll
NtQuerySystemInformation
ZwSystemDebugControl
shlwapi
SHDeleteKeyA
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE