Static task
static1
Behavioral task
behavioral1
Sample
a8b3d9784cfc0c9edea1e662ae4bcdd5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a8b3d9784cfc0c9edea1e662ae4bcdd5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a8b3d9784cfc0c9edea1e662ae4bcdd5_JaffaCakes118
-
Size
14KB
-
MD5
a8b3d9784cfc0c9edea1e662ae4bcdd5
-
SHA1
7a57db1fb7d21edc2ac41aa13d684ec33cc67fd5
-
SHA256
64edfb2718f89f3f044f8a8c794f84c228a69b7f858abc96c86b8328208370db
-
SHA512
ec44459d64c805a39451f5612861a1bd905e5223ff4d98ba237594c7a87ac59b38acace6ca7fd8b10b6e3be35c878d90bd572c22a1d8d65322d9df872c51fadc
-
SSDEEP
384:G61DCcWajig7CHwFuegUbsd5CiK6ORyVjgu:T1O9ajR7CH/73CvRypg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8b3d9784cfc0c9edea1e662ae4bcdd5_JaffaCakes118
Files
-
a8b3d9784cfc0c9edea1e662ae4bcdd5_JaffaCakes118.exe windows:1 windows x86 arch:x86
8a5c27b89b6d51bd5cf141320da93b4c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
lstrcmpi
GetModuleHandleA
ExitProcess
lstrcpy
FindNextFileA
lstrcatA
MapViewOfFile
GlobalLock
lstrlen
CreateToolhelp32Snapshot
Process32Next
RegisterServiceProcess
Process32First
lstrcmp
OpenProcess
FindFirstFileA
LoadLibraryA
CreateFileMappingA
TerminateProcess
GetWindowsDirectoryA
GetProcAddress
GetTickCount
DeleteFileA
GetExitCodeProcess
WriteFile
UnmapViewOfFile
RemoveDirectoryA
SleepEx
SetFilePointer
SetFileAttributesA
CloseHandle
FreeLibrary
GetFileSize
MoveFileA
CreateFileA
GetLogicalDriveStringsA
FindClose
GlobalUnlock
ReadFile
GlobalFree
GlobalAlloc
user32
KillTimer
RegisterClassA
SetTimer
SystemParametersInfoA
ShowWindow
SetDoubleClickTime
SetDlgItemTextA
SendMessageA
FindWindowA
PostQuitMessage
MessageBoxA
LoadStringA
GetMessageA
GetDlgItemTextA
FindWindowExA
ExitWindowsEx
EndDialog
DispatchMessageA
DialogBoxParamA
DefWindowProcA
CreateWindowExA
shell32
ShellExecuteA
advapi32
RegSetValueExA
RegQueryValueExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegEnumValueA
winmm
mciSendStringA
wsock32
socket
setsockopt
send
recv
listen
ioctlsocket
htons
gethostbyname
connect
closesocket
bind
accept
WSAStartup
WSACleanup
WSAAsyncSelect
Sections
.avp Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 1024B - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE