Static task
static1
Behavioral task
behavioral1
Sample
ad20a6340535d6488dea0626084f212b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ad20a6340535d6488dea0626084f212b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ad20a6340535d6488dea0626084f212b_JaffaCakes118
-
Size
240KB
-
MD5
ad20a6340535d6488dea0626084f212b
-
SHA1
68dd9967c0bb83c54beced8e2333991aa032b6e3
-
SHA256
1d53a674e17c78a280d214bb932fa8415fbfeafc2bdd30bb86e39839a2d3e397
-
SHA512
ce687ea03b13fcbc4252524d647592580d65d9abed46ed21184e0c9d1d5eedcfabea9718fcef6abc8a62a1c1400b815772449a35b7a5a3384c5c156dbab7b892
-
SSDEEP
6144:767UP/bcAAdnRprSktq21PygSHbTQOBKWj4vRVv:767UP/bcXdnfDtq25WA9Wj4vR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad20a6340535d6488dea0626084f212b_JaffaCakes118
Files
-
ad20a6340535d6488dea0626084f212b_JaffaCakes118.exe windows:4 windows x86 arch:x86
b8173195c1116a2642471ff763baffe9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
select
gethostbyname
gethostname
socket
inet_addr
WSAStartup
htons
ioctlsocket
connect
getsockname
shutdown
send
recv
listen
accept
bind
ntohs
closesocket
mpr
WNetAddConnection2A
WNetCancelConnection2A
kernel32
DeviceIoControl
CloseHandle
CreateFileA
lstrcmpA
ReadProcessMemory
lstrlenA
GetModuleFileNameA
GetCurrentProcessId
CreateMutexA
CreatePipe
lstrcatA
HeapAlloc
GetProcessHeap
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetFileSize
DeleteFileA
GetLocalTime
CreateDirectoryA
GetCurrentProcess
FindNextFileA
lstrcpyA
FindClose
CreateEventA
GetComputerNameA
WaitForMultipleObjects
GetTickCount
TerminateThread
WaitForSingleObject
SetEvent
ReleaseMutex
GetTempFileNameA
InterlockedExchange
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
Sleep
WriteFile
GetLastError
lstrcmpiA
ReadFile
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
FlushFileBuffers
GetVersionExA
OpenProcess
GetLongPathNameA
QueryDosDeviceA
GetProcAddress
LoadLibraryA
SetFilePointer
SetEndOfFile
RemoveDirectoryA
MoveFileA
GetModuleHandleA
GetWindowsDirectoryA
GetSystemTimeAdjustment
GetSystemTime
VirtualProtect
FindFirstFileA
SetLastError
CreateThread
VirtualAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
GetCurrentDirectoryA
GetFullPathNameA
GetStringTypeW
GetStringTypeA
HeapFree
GetTimeZoneInformation
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
ExitProcess
TlsAlloc
LCMapStringW
HeapReAlloc
RtlUnwind
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
TlsGetValue
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
GetEnvironmentStringsW
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCurrentThreadId
TlsSetValue
user32
wsprintfA
advapi32
SetKernelObjectSecurity
IsValidSid
RegQueryValueExA
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
LookupAccountNameA
LookupAccountSidA
OpenProcessToken
GetTokenInformation
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
FreeSid
GetKernelObjectSecurity
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
Sections
.text Size: 200KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE