Static task
static1
Behavioral task
behavioral1
Sample
940bf97af573e3db4b95b30e5ca1fbc2_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
940bf97af573e3db4b95b30e5ca1fbc2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
940bf97af573e3db4b95b30e5ca1fbc2_JaffaCakes118
-
Size
52KB
-
MD5
940bf97af573e3db4b95b30e5ca1fbc2
-
SHA1
f626ba6a6b008470fdf64d7d4dbbfcca92a738ea
-
SHA256
15de34d9cc3b855f3f92b601745fce2c372beb09eb91476a5fd273293d5b138b
-
SHA512
7223403571c43794c536ddead9d191da25700abefd083e7926ccf45c230284b05d1ef3f15af15a5cbfd8abb02aef8d01f0d80172e91ef6bfbf7ccb73e574dacc
-
SSDEEP
768:dKqTlDAVLGrQiomELwHVl9xnoPZBsdiB9hboY9+MiYfod3oWIQf:UqpD/ELwHVl9cIqFQpo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 940bf97af573e3db4b95b30e5ca1fbc2_JaffaCakes118
Files
-
940bf97af573e3db4b95b30e5ca1fbc2_JaffaCakes118.exe windows:4 windows x86 arch:x86
77d52eb6ffd76d0def557b4cab366458
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
FormatMessageA
lstrlenA
GetLastError
CreateThread
GetExitCodeThread
Sleep
OpenProcess
CloseHandle
OpenFile
GetSystemDirectoryA
CreateProcessA
ReadFile
LoadLibraryA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
CreateFileA
SetStdHandle
VirtualAlloc
DeleteFileA
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
HeapFree
GetCPInfo
GetACP
GetOEMCP
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
FlushFileBuffers
WriteFile
GetProcAddress
GetModuleHandleA
HeapReAlloc
HeapAlloc
HeapSize
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
SetFilePointer
SetEndOfFile
advapi32
CreateServiceA
DeleteService
RegisterServiceCtrlHandlerA
SetServiceStatus
ChangeServiceConfigA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
StartServiceA
CloseServiceHandle
StartServiceCtrlDispatcherA
wininet
InternetCloseHandle
InternetOpenUrlA
HttpQueryInfoA
InternetReadFile
InternetOpenA
InternetGetConnectedState
psapi
EnumProcesses
EnumProcessModules
GetModuleFileNameExA
Sections
.text Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 512KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE