Static task
static1
Behavioral task
behavioral1
Sample
b5e1aafbd7bc0546d45306cff5b4c233_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b5e1aafbd7bc0546d45306cff5b4c233_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b5e1aafbd7bc0546d45306cff5b4c233_JaffaCakes118
-
Size
245KB
-
MD5
b5e1aafbd7bc0546d45306cff5b4c233
-
SHA1
265162e23ee9c4b70af499d28572a8aa8c18a0ff
-
SHA256
58e5607127bd488bd6d9715bc0d2a6691c69c358bc40c28bd85945419642f16a
-
SHA512
3cc35c112f2bae08461a6dcd589436d5e4cb25b952fa7303a102389ad35937415b52a8219897ffe144b9e8de97827474eeb9871da518a43fde3572e50ed5ab5b
-
SSDEEP
6144:1H2fMEbcU+mJPuiEwEXigJ7laz2Sg+JZxISf94i:1U/+uu9XiSf02SV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b5e1aafbd7bc0546d45306cff5b4c233_JaffaCakes118
Files
-
b5e1aafbd7bc0546d45306cff5b4c233_JaffaCakes118.exe windows:4 windows x86 arch:x86
15514fd9c94883e7e0c8ca1d21804d7a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
sendto
recvfrom
bind
listen
accept
ntohl
ioctlsocket
WSACleanup
WSAStartup
gethostbyname
getsockopt
getservbyname
ntohs
htons
htonl
socket
setsockopt
connect
send
WSASetLastError
recv
WSAGetLastError
shutdown
closesocket
gdi32
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
GetObjectA
BitBlt
GetBitmapBits
DeleteObject
DeleteDC
CreateDCA
advapi32
ReportEventA
DeregisterEventSource
RegisterEventSourceA
user32
MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
kernel32
SetLastError
CloseHandle
FreeLibrary
FindClose
FindFirstFileA
FindNextFileA
GetStdHandle
GlobalMemoryStatus
FlushConsoleInputBuffer
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetFileType
GetCurrentThreadId
GetModuleHandleA
VirtualAlloc
query
FsCiShutdown
LoadIFilter
CITextToFullTree
InitializeCIPerformanceData
DllGetClassObject
DoneFILTERPerformanceData
tsbyuv
DriverProc
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.btLRyF Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.egwDod Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.RYKM Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 213KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.RGD Size: 1024B - Virtual size: 833B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.BVQcBX Size: 512B - Virtual size: 530B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tLLa Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ