Static task
static1
Behavioral task
behavioral1
Sample
b2d64e895c7544f07761c10f326de19f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b2d64e895c7544f07761c10f326de19f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b2d64e895c7544f07761c10f326de19f_JaffaCakes118
-
Size
159KB
-
MD5
b2d64e895c7544f07761c10f326de19f
-
SHA1
1be40b4cfcae51490e481ff081d62037c630f707
-
SHA256
49503d1fe4c302df8984b52fc41f2b5fe65312a1fa5e6cdec11d6a3e1dacc2b2
-
SHA512
c53af1bcf0939621e58fdfd9bd0f5572c05bb983f2492f8be10582ddbf2089b7107b6ddbb92ee3fdb488342dd2e21c8720c868ee4495a77b994d697707c9f475
-
SSDEEP
3072:QwDO3XZGHngXrvrEBjtnJHA6s19+jTRRcb/hjWURbp5nFs05BsyDMG6aTk77hDav:jDOHZGAbDELndsw9qbJjzp5nFss+G6le
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b2d64e895c7544f07761c10f326de19f_JaffaCakes118
Files
-
b2d64e895c7544f07761c10f326de19f_JaffaCakes118.exe windows:1 windows x86 arch:x86
bf2a821964715937349e7ee1a5721319
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ShellExecuteW
kernel32
EnterCriticalSection
lstrcatW
lstrcpyW
CloseHandle
GetLocaleInfoA
FindNextFileA
SetConsoleNumberOfCommandsW
GetCurrentProcess
FindFirstFileA
GetFirmwareEnvironmentVariableA
DeleteFileW
GetSystemDefaultLCID
CreateFileA
GetFileSizeEx
CreateFileW
GetWindowsDirectoryA
VirtualFree
GetLastError
QueryDosDeviceW
ReadFile
WriteFile
CreateTimerQueueTimer
lstrcatA
Sleep
HeapCreate
ValidateLCType
GetTickCount
GetSystemDirectoryA
DuplicateHandle
DeleteFileA
LocalShrink
PrivCopyFileExW
CmdBatNotification
GetModuleHandleA
SetFileApisToANSI
lstrcpyA
DeleteVolumeMountPointW
CopyFileA
GetConsoleInputWaitHandle
VerLanguageNameA
SetLastConsoleEventActive
ExpandEnvironmentStringsW
GetEnvironmentStringsW
VirtualAlloc
CreateSemaphoreA
GetSystemDirectoryW
GetProcAddress
FindClose
FlushFileBuffers
SetFileAttributesW
InitializeCriticalSection
LeaveCriticalSection
OpenProcess
lstrlenA
GetModuleFileNameA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegCreateKeyA
LsaLookupPrivilegeName
GetSecurityDescriptorGroup
SetInformationCodeAuthzPolicyW
OpenProcessToken
StartTraceW
CloseServiceHandle
DuplicateEncryptionInfoFile
AdjustTokenPrivileges
OpenSCManagerA
EnumServicesStatusA
LookupPrivilegeValueA
RegSetValueExA
ntdll
vsprintf
wcsstr
isspace
sprintf
strncmp
memset
RtlInitAnsiString
RtlFreeUnicodeString
NtQueryObject
_chkstk
strlen
tolower
strstr
ZwLoadDriver
memcpy
RtlAnsiStringToUnicodeString
NtQuerySystemInformation
isdigit
psapi
EnumProcesses
GetProcessImageFileNameA
ws2_32
closesocket
htons
getaddrinfo
socket
WSAStartup
select
connect
getpeername
send
inet_ntoa
htons
gethostbyname
WSApSetPostRoutine
__WSAFDIsSet
recv
htonl
ole32
CoCreateGuid
user32
CharLowerW
ExitWindowsEx
VRipOutput
Sections
.data Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512B - Virtual size: 405B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ