Static task
static1
Behavioral task
behavioral1
Sample
a24d57ebb1788790472de948198b7977_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a24d57ebb1788790472de948198b7977_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a24d57ebb1788790472de948198b7977_JaffaCakes118
-
Size
24KB
-
MD5
a24d57ebb1788790472de948198b7977
-
SHA1
741cac3d15c42c6e4f9ec8bbdf49e24375aeeac5
-
SHA256
a429603264003a71e571647d2caf4c6aab0be6993e8324f8437dfb658fd65fc1
-
SHA512
37e08b7e62a07e9fe998f48de12944d0625c02255450522d555057e8deae0aa12245392c5ae70d79b58d4d52110b45ac898f1a6bb6fcb5c6a49d52e9fd335847
-
SSDEEP
384:Mcm8tMPbDyZtQe0NPipIVa+Uvo99miubzHd9Fy1TjP9VwVc:G8tMPbeAPgdvEIzHqnXwVc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a24d57ebb1788790472de948198b7977_JaffaCakes118
Files
-
a24d57ebb1788790472de948198b7977_JaffaCakes118.exe windows:4 windows x86 arch:x86
22fbc023ab74326cbda4c50c3530020f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
shell32
ShellExecuteExA
ShellExecuteA
ws2_32
WSAStartup
WSACleanup
recv
closesocket
htons
socket
connect
inet_addr
gethostbyname
send
urlmon
URLDownloadToFileA
msvcrt
rand
free
malloc
strcspn
strncmp
srand
_exit
remove
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
_onexit
_snprintf
vsprintf
atoi
strcmp
strchr
strncpy
strlen
memmove
strcpy
memset
sprintf
_XcptFilter
kernel32
GetStartupInfoA
GetFileAttributesA
WaitForSingleObject
TerminateThread
GetTickCount
CreateMutexA
ReleaseMutex
GetLocaleInfoA
GetVersionExA
GetModuleHandleA
CreateThread
ExitProcess
ExpandEnvironmentStringsA
CreateProcessA
lstrcatA
CreateDirectoryA
GetLastError
SetFileAttributesA
CreateFileA
WriteFile
CloseHandle
lstrlenA
GetModuleFileNameA
CopyFileA
Sleep
GetLogicalDriveStringsA
GetDriveTypeA
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ