Static task
static1
Behavioral task
behavioral1
Sample
ab00834fc21d1959316fc64c1c0575e2_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ab00834fc21d1959316fc64c1c0575e2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ab00834fc21d1959316fc64c1c0575e2_JaffaCakes118
-
Size
56KB
-
MD5
ab00834fc21d1959316fc64c1c0575e2
-
SHA1
a8abc30f4993f6819153ccab28b3777b1c6070c5
-
SHA256
0c5b7dec4e924ddfb30031fdc85431a3c893910f33aae614272d3b7f788977b3
-
SHA512
1f4c620515e86c461fd77a0537c559a73e5889521bfae21e244440f3f829a2c62af6f8bd037f6f4b6c98b208597f12b7ebfa869e2f1558dd540bcac28c960ea6
-
SSDEEP
1536:y+2Ds6AL2dGp6g3mh04iZFVUW+BFbPHGIDCHmavPqmMw:B2Ds6AL2dGwfG3GavPq/w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ab00834fc21d1959316fc64c1c0575e2_JaffaCakes118
Files
-
ab00834fc21d1959316fc64c1c0575e2_JaffaCakes118.exe windows:4 windows x86 arch:x86
3b8330ff3fe7bb21a7124c9859dcb7fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetProcessWorkingSetSize
WaitForSingleObject
GetShortPathNameA
WinExec
GetProcessId
GetTempFileNameA
GetBinaryTypeA
CreateFileA
GetFileSize
SetFilePointer
ReadFile
CreateProcessA
RtlMoveMemory
GetModuleHandleA
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetTempPathA
MoveFileExA
Sleep
RtlFillMemory
HeapAlloc
GetProcessHeap
CloseHandle
OpenProcess
GetOEMCP
DeleteFileA
lstrlen
CreateMutexA
lstrcpynA
OpenMutexA
psapi
EnumProcesses
GetModuleFileNameExA
shlwapi
PathFindFileNameA
PathFileExistsA
user32
wvsprintfA
FindWindowA
PostMessageA
wsprintfA
MessageBoxA
GetAncestor
GetWindowTextA
EnumChildWindows
GetWindowThreadProcessId
EnumWindows
WaitForInputIdle
ShowWindow
urlmon
URLDownloadToFileA
shell32
SHGetSpecialFolderPathA
ShellExecuteEx
SHFileOperationA
wininet
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
iphlpapi
GetAdaptersInfo
advapi32
CryptAcquireContextA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
msvcrt
rand
srand
tolower
_strnicmp
strncmp
??3@YAXPAX@Z
sprintf
_CIfmod
atoi
_ftol
strchr
memmove
modf
free
malloc
strncpy
Sections
.text Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE