Static task
static1
Behavioral task
behavioral1
Sample
8ea1714ca2e89769e068c6aafc336715_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8ea1714ca2e89769e068c6aafc336715_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8ea1714ca2e89769e068c6aafc336715_JaffaCakes118
-
Size
376KB
-
MD5
8ea1714ca2e89769e068c6aafc336715
-
SHA1
cdce16170cb82ebb784976ed25e2c2d77c08bd97
-
SHA256
34056127f689da013f96a1543b381c9bb135b3ada382929fcb279593ca933e25
-
SHA512
048338fc5e9385308299ac16a21e092f6ca645443e2e55ed0b3544b9e0f317d1b80caec520cda30ddab0b1731fdb661613ba90e71c7e893687bcd18ab59a753e
-
SSDEEP
6144:bk82QC+N3I7FtwqpOtAzoTkIUawwLrlC+BhH39nOICqYeAvCMjwQRESpiyK08:bkXw67vUtslyLwOhH395uvvzU0EWx8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8ea1714ca2e89769e068c6aafc336715_JaffaCakes118
Files
-
8ea1714ca2e89769e068c6aafc336715_JaffaCakes118.exe windows:4 windows x86 arch:x86
c06b312f251a556eec4d7f420b7a1331
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ulib
?QueryNumber@WSTRING@@QBEEPAJKK@Z
?SetOcts@COMM_DEVICE@@QAEEE@Z
?Resize@BDSTRING@@UAEEK@Z
?Initialize@SCREEN@@QAEEXZ
?Initialize@SORTED_LIST@@QAEEE@Z
?UseAlternateName@FSNODE@@QAEEXZ
?EnableLineMode@KEYBOARD@@QAEEXZ
?Cast@SCREEN@@SGPAV1@PBVOBJECT@@@Z
?GetPFlagBreak@KEYBOARD@@QBEQAHXZ
?Put@SORTED_LIST@@UAEEPAVOBJECT@@@Z
?HasWildCard@PATH@@QBEEXZ
?Strchr@BSTRING@@QBEKDK@Z
??1SORTED_LIST@@UAE@XZ
?SetOdsr@COMM_DEVICE@@QAEEE@Z
ole32
OleRun
OleCreateLinkToFileEx
CoGetPSClsid
OleCreateFromFileEx
OleIsCurrentClipboard
OleRegEnumFormatEtc
CoRegisterMallocSpy
OleLoadFromStream
OleSetContainedObject
CoMarshalInterThreadInterfaceInStream
OleDuplicateData
OleCreateLinkEx
kernel32
CloseHandle
VirtualAlloc
CreateFileA
GetModuleHandleA
GetCurrentThreadId
ReadFile
GetTickCount
GetCurrentProcessId
LCMapStringA
LoadModule
Toolhelp32ReadProcessMemory
GetPrivateProfileStringA
LocalSize
advapi32
ControlService
GetSidIdentifierAuthority
LookupAccountNameW
IsValidSid
RegConnectRegistryW
SetTokenInformation
QueryServiceConfigW
OpenProcessToken
RegEnumValueW
RegSetValueExW
RegQueryValueExW
GetLengthSid
msvcrt
free
wcsncmp
strstr
strcpy
_itoa
_wctime
_beginthread
strncmp
_initterm
sprintf
exit
_onexit
_snprintf
Sections
.text Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ