Static task
static1
Behavioral task
behavioral1
Sample
8b3e337f0929668794afec93c82eb116_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8b3e337f0929668794afec93c82eb116_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8b3e337f0929668794afec93c82eb116_JaffaCakes118
-
Size
266KB
-
MD5
8b3e337f0929668794afec93c82eb116
-
SHA1
4b0993a9acea5ec3b2e024bb5bf9691539aa08fe
-
SHA256
96c29b8b28b3d0800fcd80cad66176bdfc71314326fa08004989cad61fa76c98
-
SHA512
e40d6ed3377f199aa583c614b8d70b07f4c7c03fa7ce566dc7e7d2822c938393c6d0e66b0fe20604eeb74b3cd5d57a817dd3fddd376f28288da5a4de4c018dde
-
SSDEEP
6144:+Gl75MNTwpRAO02kWWIkFFNyL90lKKhjgcDRznAqnlC:Tl75MwRd0KGF+2gSdAglC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8b3e337f0929668794afec93c82eb116_JaffaCakes118
Files
-
8b3e337f0929668794afec93c82eb116_JaffaCakes118.exe windows:4 windows x86 arch:x86
02856246266695b606cad3a06af2d7cb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
WSAGetLastError
WSACreateEvent
WSACloseEvent
socket
closesocket
gethostbyname
ntohs
send
recv
shutdown
connect
WSAEnumNetworkEvents
WSAAccept
htonl
htons
bind
listen
WSAEventSelect
inet_addr
gethostname
WSAStartup
urlmon
FindMimeFromData
kernel32
WaitForMultipleObjects
lstrlenW
lstrcpynW
CreateDirectoryW
WaitForSingleObject
LocalFree
CreateEventW
lstrcpyW
OpenEventW
CreateMutexW
GetModuleHandleW
GetTempPathW
GetTimeFormatW
GetDateFormatW
GetLocalTime
FreeLibrary
TlsAlloc
GetProcessHeap
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
GetProcAddress
advapi32
ConvertStringSidToSidW
CreateProcessAsUserW
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
ControlService
DeleteService
CreateServiceW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegConnectRegistryW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceW
QueryServiceStatus
LookupPrivilegeValueW
AdjustTokenPrivileges
GetSecurityInfo
GetSecurityDescriptorDacl
GetUserNameW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetSecurityInfo
DuplicateTokenEx
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenProcessToken
GetTokenInformation
LookupAccountSidW
SetTokenInformation
ole32
CoCreateInstance
CoInitialize
CoUninitialize
user32
wsprintfW
quartz
AMGetErrorTextW
DllUnregisterServer
kbdpl
KbdLayerDescriptor
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.oxof Size: 4KB - Virtual size: 874KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.P Size: 4KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zRSiO Size: 1024B - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.m Size: 98KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.KboI Size: 1024B - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.QWfT Size: 1024B - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hHWMk Size: 5KB - Virtual size: 555KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VRSfVp Size: 119KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uey Size: 2KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ