Static task
static1
Behavioral task
behavioral1
Sample
958a71caec61dfbfa0f1521b1de216b3_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
958a71caec61dfbfa0f1521b1de216b3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
958a71caec61dfbfa0f1521b1de216b3_JaffaCakes118
-
Size
46KB
-
MD5
958a71caec61dfbfa0f1521b1de216b3
-
SHA1
6d2208ee7c428fe4b3f8aff83916ace1b765bacd
-
SHA256
69c8f8eb5b06480b14cdd9d7f17c5412eb193086033b4ba88801435fe0acdd51
-
SHA512
f35826736e2dedcddfeac2e754932dea183726a317749a68b189831cffaa13da4001fa2d016017e74b1b3277e32ca7d9d305cd99e376e31cd2c6a3b081d7d05d
-
SSDEEP
768:Yz1wV+XS+k9ylkrzLMQIjQExSO4+FDtL2lw7z3Fj9wbPk54ZJ42A+Ep:Yyx9mkr0G+hGYVj9wbcqZe2Ahp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 958a71caec61dfbfa0f1521b1de216b3_JaffaCakes118
Files
-
958a71caec61dfbfa0f1521b1de216b3_JaffaCakes118.exe windows:5 windows x86 arch:x86
20e41ce01f80755f4eea7fc12deb3017
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
ZwReadFile
ZwQueryInformationFile
strrchr
ZwCreateFile
ZwWriteFile
ZwQueryVolumeInformationFile
ZwQueryDirectoryFile
wcslen
ZwSetInformationFile
RtlAdjustPrivilege
RtlIpv4StringToAddressA
ZwOpenThreadTokenEx
_wcsicmp
strcmp
strcpy
sprintf
memcmp
strchr
ZwSetSecurityObject
LdrAccessResource
wcsrchr
swprintf
strlen
RtlDestroyQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlCreateQueryDebugBuffer
RtlEqualUnicodeString
ZwQuerySystemInformation
ZwSuspendThread
ZwQueryInformationThread
ZwOpenThread
_stricmp
RtlNtStatusToDosError
RtlIpv4AddressToStringA
ZwClose
ZwEnumerateKey
ZwOpenKey
ZwQueryKey
ZwResumeThread
ZwLoadDriver
ZwCreateSymbolicLinkObject
ZwUnmapViewOfSection
ZwFlushVirtualMemory
RtlImageNtHeader
ZwMapViewOfSection
ZwCreateSection
ZwFsControlFile
ZwOpenFile
ZwSetValueKey
ZwCreateKey
LdrFindResource_U
RtlInitUnicodeString
ZwAdjustPrivilegesToken
memset
RtlIpv4StringToAddressW
ZwQueryValueKey
ZwImpersonateThread
memcpy
kernel32
DeleteTimerQueueTimer
Sleep
GetVersion
ExitProcess
GetTickCount
CreateTimerQueueTimer
VirtualAlloc
GetSystemTimeAsFileTime
GetLastError
BindIoCompletionCallback
LocalFree
LocalAlloc
advapi32
MD5Update
MD5Final
MD5Init
ws2_32
WSACleanup
WSARecvFrom
WSASendTo
setsockopt
WSASend
WSARecv
WSAIoctl
bind
closesocket
WSAGetLastError
WSASocketW
WSAStartup
cabinet
ord20
ord22
ord23
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 432B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ