Static task
static1
Behavioral task
behavioral1
Sample
95598cf0a4dc9088927fc60584e832ff_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
95598cf0a4dc9088927fc60584e832ff_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
95598cf0a4dc9088927fc60584e832ff_JaffaCakes118
-
Size
28KB
-
MD5
95598cf0a4dc9088927fc60584e832ff
-
SHA1
492c636effda52689c07ef740b90df97a08d29d3
-
SHA256
82df56ee767d043dc0968698a6cd8f25c3a7e75fe5919f14d354022fdfb7ca73
-
SHA512
71289fcb3dda8820cd8941832d605a216f5400c126f8d0c010c06306bdca04a4adbc280ae33fb33078b751ad52c5aa5354481da90f9a297b2097802129ecdb41
-
SSDEEP
384:tlyB7E2SB1Dq/z7dXbtmH6EJgIvV1xFF7Lr3:ASHDqr7dXb4xJV1rF7H
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 95598cf0a4dc9088927fc60584e832ff_JaffaCakes118
Files
-
95598cf0a4dc9088927fc60584e832ff_JaffaCakes118.exe windows:4 windows x86 arch:x86
4608a4d269e045433106c77bdd26c9ae
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FormatMessageA
CloseHandle
CreateDirectoryA
CopyFileA
DeleteFileA
MoveFileA
_lclose
_lwrite
_llseek
_lcreat
_lopen
GetLocalTime
GetCurrentThread
GetCurrentThreadId
WaitForSingleObject
WaitForMultipleObjects
GetModuleFileNameA
DisconnectNamedPipe
WriteFile
GetOverlappedResult
ReadFile
ConnectNamedPipe
SetLastError
ResetEvent
CreateNamedPipeA
CreateEventA
SetEvent
FreeResource
ExpandEnvironmentStringsA
LockResource
LoadResource
FindResourceA
GetVersionExA
GetLastError
LocalAlloc
lstrcpyA
lstrcmpiA
Sleep
LocalFree
EnterCriticalSection
LeaveCriticalSection
CreateThread
lstrlenA
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
DebugBreak
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleA
GetCommandLineA
ExitProcess
GetStartupInfoA
GetProcAddress
lstrcpynA
user32
CharNextA
wsprintfA
advapi32
OpenThreadToken
RevertToSelf
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenServiceA
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
StartServiceA
QueryServiceStatus
CloseServiceHandle
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
ImpersonateNamedPipeClient
InitializeSecurityDescriptor
DuplicateTokenEx
shlwapi
SHDeleteValueA
SHDeleteKeyA
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ