Static task
static1
Behavioral task
behavioral1
Sample
78b0bd856f35c1d298aafdce6c5cfbc2_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
78b0bd856f35c1d298aafdce6c5cfbc2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
78b0bd856f35c1d298aafdce6c5cfbc2_JaffaCakes118
-
Size
12KB
-
MD5
78b0bd856f35c1d298aafdce6c5cfbc2
-
SHA1
5c73b995efe593c0f2d28b4ce4d88a4bed0c1c4d
-
SHA256
47985ca13cb195e4f476c8dd6378c7732a20678a7ac4ad6b20b329295b4eee61
-
SHA512
e0f70fe3269b77ec09ae5906a9b54040ebf1cedc7d7eb1e631bf3fd255932a8c96d98220c9c72ec1e5ded59e04e538f3be1393c7ac98208b4521c8fb71f2e632
-
SSDEEP
384:/dBOQ29c7FXXZNJhCW4amqZbfYM3zTAN6xN+8OdZftSF:/dBOQ29c7FXXZNJhCW4amqZbTRODftA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 78b0bd856f35c1d298aafdce6c5cfbc2_JaffaCakes118
Files
-
78b0bd856f35c1d298aafdce6c5cfbc2_JaffaCakes118.exe windows:1 windows x86 arch:x86
cf921f0db88fa93d18973ae4b7df0c76
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
WSACleanup
WSAStartup
accept
bind
closesocket
htonl
htons
listen
recv
select
send
socket
urlmon
URLDownloadToFileA
kernel32
ExitThread
FreeLibrary
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetLastError
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetVersionExA
LoadLibraryA
OpenProcess
PeekNamedPipe
ReadFile
RtlUnwind
Sleep
TerminateProcess
TerminateThread
WaitForMultipleObjects
CreatePipe
WinExec
CreateProcessA
WriteFile
lstrlenA
CreateThread
DisconnectNamedPipe
DuplicateHandle
user32
ExitWindowsEx
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
OpenSCManagerA
OpenServiceA
RegCloseKey
RegDeleteValueA
RegOpenKeyA
RegSetValueExA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
CloseServiceHandle
CreateServiceA
DeleteService
crtdll
__GetMainArgs
_strnicmp
atoi
exit
free
malloc
memcpy
memset
raise
signal
strcat
strchr
strcmp
strpbrk
strstr
strtok
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 268B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE