Static task
static1
Behavioral task
behavioral1
Sample
8655f18c6eed30f8813a1a61df4a690c_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8655f18c6eed30f8813a1a61df4a690c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8655f18c6eed30f8813a1a61df4a690c_JaffaCakes118
-
Size
272KB
-
MD5
8655f18c6eed30f8813a1a61df4a690c
-
SHA1
8eda977e1d56587469ca06dcecddd4d336380358
-
SHA256
431a49dbe4cacdd7fb9d9340e0f9f81b9670fbb9acc2ed2715532f82177830c8
-
SHA512
7c3d4753ad49f91881f6efe51686ccac7031dde9ad89006cc8a7ec79d969348716710c72f1e9f611f0ff4aee87568464ee2be41b97dd0d2096449b50d60fe580
-
SSDEEP
6144:u5jq/uEdi9DfQ40l6VHsX5j+i93UYO4QH0hY:AjcSDIwMpD9EN4Q+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8655f18c6eed30f8813a1a61df4a690c_JaffaCakes118
Files
-
8655f18c6eed30f8813a1a61df4a690c_JaffaCakes118.exe windows:4 windows x86 arch:x86
6bfbeaa9f6d7d0dad778b86b16f1eb51
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetComputerNameA
GetModuleHandleA
CopyFileA
FindClose
FindNextFileA
FindFirstFileA
TerminateProcess
OpenProcess
GetShortPathNameA
SetEvent
OpenEventA
GetCurrentProcessId
WaitForMultipleObjects
SetComputerNameA
InterlockedDecrement
GetFileSize
ReadFile
WriteFile
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryA
GetProcAddress
WideCharToMultiByte
FreeLibrary
MultiByteToWideChar
GetModuleFileNameA
ResetEvent
LocalFree
SetEnvironmentVariableA
GetLastError
CreateEventA
CreateProcessA
WaitForSingleObject
GetSystemDirectoryA
GetLocalTime
GetVersion
SetFileAttributesA
DeleteFileA
CreateDirectoryA
Sleep
GetCurrentProcess
CreateFileA
DeviceIoControl
GetVersionExA
CloseHandle
CompareStringW
CompareStringA
SetEndOfFile
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
lstrcmpiA
RemoveDirectoryA
GetExitCodeProcess
GetEnvironmentVariableA
HeapFree
HeapAlloc
GetCurrentThread
SetFilePointer
GetTickCount
SetLastError
GlobalAlloc
GlobalFree
RtlUnwind
ExitProcess
GetTimeZoneInformation
GetSystemTime
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
GetStartupInfoA
GetCommandLineA
HeapReAlloc
InterlockedIncrement
TlsAlloc
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
RaiseException
user32
LoadCursorA
RegisterClassExA
UpdateWindow
ShowWindow
SetTimer
CreateWindowExA
DestroyWindow
GetMessageA
TranslateMessage
DispatchMessageA
FindWindowA
SendMessageA
LoadIconA
DefWindowProcA
SetWindowLongA
GetClassInfoExA
GetWindowLongA
GetCursorPos
KillTimer
PostMessageA
GetDesktopWindow
GetParent
advapi32
QueryServiceConfigA
ChangeServiceConfigA
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
OpenServiceA
CloseServiceHandle
StartServiceA
RegQueryInfoKeyA
RegEnumValueA
RegQueryValueExA
RegEnumKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
CreateProcessAsUserA
DuplicateTokenEx
RevertToSelf
SetTokenInformation
OpenThreadToken
ImpersonateSelf
QueryServiceStatus
oleaut32
VariantClear
ws2_32
closesocket
WSACloseEvent
ioctlsocket
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSAEventSelect
WSACreateEvent
send
WSAStartup
WSAAccept
listen
bind
htons
WSASocketA
inet_ntoa
gethostname
recv
WSACleanup
gethostbyname
WSAGetLastError
connect
inet_addr
WSARecv
WSASend
setsockopt
socket
shutdown
WSAAsyncSelect
netapi32
Netbios
gdi32
GetStockObject
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 204KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ