Static task
static1
Behavioral task
behavioral1
Sample
a6d63c3738b773c39f843579beab70ff_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a6d63c3738b773c39f843579beab70ff_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a6d63c3738b773c39f843579beab70ff_JaffaCakes118
-
Size
43KB
-
MD5
a6d63c3738b773c39f843579beab70ff
-
SHA1
7c028aa66b53cce740954bab4801b615cdfac69d
-
SHA256
718e46514713a6d3a1d8bbbac8b4917dc925ee9741761808df62c9fefec45349
-
SHA512
8eca674910542d3b1fad73654effb910dc12f0631a4f3c1adc0d520e0527f13a4b49a9e1df91fec29bf16608c9d0814b9769f8a46eac8fb6660a976fc8096ca0
-
SSDEEP
768:g8wLs9aey6c3WZ10/BCndoz3QiDGo9hxJcWor7v:cOyX810ydozND3LcWorz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6d63c3738b773c39f843579beab70ff_JaffaCakes118
Files
-
a6d63c3738b773c39f843579beab70ff_JaffaCakes118.exe windows:4 windows x86 arch:x86
fdeef0d2845848c21a4fd96841faf0de
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CreateStreamOnHGlobal
kernel32
ReadFile
OpenProcess
UnmapViewOfFile
MapViewOfFile
ReleaseMutex
WideCharToMultiByte
GetExitCodeProcess
WriteFile
lstrcatA
lstrcmpiA
lstrcpyA
LocalFree
Sleep
lstrlenW
lstrlenA
LocalAlloc
LoadLibraryA
GlobalMemoryStatus
GlobalFree
GetVolumeInformationA
GetVersionExA
GetTickCount
GetTempPathA
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileIntA
GetLogicalDrives
GetLocalTime
GetLastError
GetFileSize
GetDriveTypeA
GetDiskFreeSpaceA
GetComputerNameA
ExpandEnvironmentStringsA
CreateFileMappingA
CreateFileA
CloseHandle
CreateProcessA
lstrcpynA
user32
SetActiveWindow
mouse_event
SetCursorPos
GetCursorPos
wsprintfA
GetWindowRect
advapi32
GetUserNameA
RegQueryValueExA
RegOpenKeyA
RegEnumValueA
RegEnumKeyExA
RegCloseKey
shlwapi
StrStrIA
shell32
ShellExecuteA
wsock32
gethostname
gethostbyname
connect
closesocket
WSAStartup
socket
crypt32
CryptUnprotectData
Sections
Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 349B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 227B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 258B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nah Size: 305B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE