Static task
static1
Behavioral task
behavioral1
Sample
9feb5403fb048f6b4340146e02ecac8e_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
9feb5403fb048f6b4340146e02ecac8e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
9feb5403fb048f6b4340146e02ecac8e_JaffaCakes118
-
Size
320KB
-
MD5
9feb5403fb048f6b4340146e02ecac8e
-
SHA1
2b94b09d7b051d83ae478eee2c4961972edbcbf4
-
SHA256
0bb96168861eeb4ba605e46e25eda4a798854584cb2d28bb8fbb719f7fa4f996
-
SHA512
136ecb1662ee29770b9448f6727f63d34359e15a98be716e618cc2dfab6b1c0f835ebde9e85103bc31e344ada93e025def75f556ec2209e251d1f5727ffb687d
-
SSDEEP
6144:CfCh6daIFgJtUAISdYLmsYLV9OjceKxSz6AbZIAAVkgmK:CfC4dacgJtUAISdOYL+jc7Vf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9feb5403fb048f6b4340146e02ecac8e_JaffaCakes118
Files
-
9feb5403fb048f6b4340146e02ecac8e_JaffaCakes118.exe windows:4 windows x86 arch:x86
7d86ae4038f9b337ec0d0d90b6e6359e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetAddConnection2A
rpcrt4
UuidToStringA
UuidFromStringA
ws2_32
bind
listen
accept
recv
gethostbyname
inet_addr
ioctlsocket
connect
shutdown
closesocket
socket
send
select
__WSAFDIsSet
setsockopt
WSACleanup
WSAStartup
htons
kernel32
GetComputerNameA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetEndOfFile
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
FlushFileBuffers
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
Sleep
GetModuleFileNameA
MultiByteToWideChar
ReadFile
CloseHandle
WriteFile
TransactNamedPipe
CreateFileA
SetFilePointer
GetFileSize
GetTickCount
GetLastError
CopyFileA
WideCharToMultiByte
CreateThread
ExitThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLocalTime
GetSystemDirectoryA
ExitProcess
CreateProcessA
FindClose
FindNextFileA
FindFirstFileA
FreeLibrary
GetEnvironmentVariableW
GetProcAddress
LoadLibraryA
HeapFree
HeapAlloc
GetProcessHeap
FileTimeToSystemTime
FileTimeToLocalFileTime
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
OpenProcess
GetTimeFormatA
GetDateFormatA
GetFileAttributesA
GetModuleHandleA
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
ExpandEnvironmentStringsA
SetFileAttributesA
GetTempPathA
GetCurrentProcess
TerminateProcess
DeleteFileA
GetCurrentProcessId
WaitForSingleObject
CreateMutexA
TerminateThread
MoveFileA
GetExitCodeProcess
PeekNamedPipe
DuplicateHandle
CreatePipe
SetConsoleCtrlHandler
GetLocaleInfoA
GetVersionExA
GetLogicalDrives
WaitForMultipleObjects
GenerateConsoleCtrlEvent
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalMemoryStatus
IsBadWritePtr
IsBadReadPtr
HeapValidate
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
GetStartupInfoA
GetCommandLineA
GetVersion
RaiseException
InitializeCriticalSection
FatalAppExitA
DebugBreak
GetStdHandle
OutputDebugStringA
HeapReAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
Sections
.text Size: 222KB - Virtual size: 222KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 67KB - Virtual size: 385KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ