Static task
static1
Behavioral task
behavioral1
Sample
b64ad4bb77adcc3b72fe892d76d7c47c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b64ad4bb77adcc3b72fe892d76d7c47c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b64ad4bb77adcc3b72fe892d76d7c47c_JaffaCakes118
-
Size
84KB
-
MD5
b64ad4bb77adcc3b72fe892d76d7c47c
-
SHA1
844751feaff515a0a8b722115e4e8d6470f23376
-
SHA256
26cc446a83e8e2e7cf7e32c952c4735124e32d33c101e7ffb3c20a368b53afe9
-
SHA512
35b10ae007936bda2fc996e842f25649ab37cf6ee37687e465c6e88801c14e1319d711777fce04eb5d863da4b43c0b6dd2c8c0fc73b5beef086c9b6c6548b1a4
-
SSDEEP
1536:rWpep+M7APezlWL6w6ZiTUPiYR3RER1ELwWltR:yWIezsYfhE3ELwWl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b64ad4bb77adcc3b72fe892d76d7c47c_JaffaCakes118
Files
-
b64ad4bb77adcc3b72fe892d76d7c47c_JaffaCakes118.exe windows:4 windows x86 arch:x86
0f20bd48123f0281f068a2c2ca4f92b0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
DeleteFileA
SetFileAttributesA
GetTempPathA
CreateProcessA
CopyFileA
GetVersion
GetModuleFileNameA
CreateDirectoryA
GetCurrentProcess
FreeLibrary
GetCurrentProcessId
GetProcAddress
GetLastError
SetFileTime
SystemTimeToFileTime
CreateFileA
ExitProcess
GetModuleHandleA
GetStartupInfoA
WriteFile
LockResource
SizeofResource
LoadResource
FindResourceA
GetVolumeInformationA
SetEnvironmentVariableA
CompareStringW
CloseHandle
GetWindowsDirectoryA
FindFirstFileA
FindClose
GetComputerNameA
GetVersionExA
GetLogicalDrives
GetDriveTypeA
GetDiskFreeSpaceExA
GetACP
CreateThread
LoadLibraryA
Sleep
CompareStringA
LCMapStringW
LCMapStringA
GetOEMCP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
GetLocalTime
TerminateProcess
RtlUnwind
HeapFree
HeapAlloc
GetCommandLineA
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
HeapSize
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetFilePointer
InterlockedDecrement
user32
wsprintfA
advapi32
RegDeleteValueA
RegEnumKeyExA
RegSetValueExA
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyA
ws2_32
WSACleanup
ntohl
getsockname
WSAStartup
recv
select
gethostbyname
inet_addr
connect
shutdown
closesocket
htonl
htons
socket
send
inet_ntoa
netapi32
Netbios
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PWDDATA Size: 4KB - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ