Static task
static1
Behavioral task
behavioral1
Sample
b6aed2ab3bcdeab486133066895bbf06_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b6aed2ab3bcdeab486133066895bbf06_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b6aed2ab3bcdeab486133066895bbf06_JaffaCakes118
-
Size
76KB
-
MD5
b6aed2ab3bcdeab486133066895bbf06
-
SHA1
6d674c982a9e6d5258d88e101893df7bc419233c
-
SHA256
b001522dc6fee8528d05629e51cd8fb45ab90db7b82cb8a08dd68b5ae778b1f7
-
SHA512
174fddd632625969fea592ee88e495feb3509060baac3185e1cd25f15bf2e82e219bef42fa8022d9f29ce4296410f417a5c3e9c32db90bf050aa3d461431052c
-
SSDEEP
768:t2V9nBTvMl0ryQqIowKQvePanVdqIEH8VKHaEfzeo19RenOXWALR80GQaFzOUuZ8:tOrTSQvePSFEIKDJ9RenOXCFzOskoB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6aed2ab3bcdeab486133066895bbf06_JaffaCakes118
Files
-
b6aed2ab3bcdeab486133066895bbf06_JaffaCakes118.exe windows:4 windows x86 arch:x86
aed0ac8b3cd0a7a80c4301c6ae7a3787
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetAddConnection2A
WNetCancelConnection2A
kernel32
SizeofResource
LoadResource
FindResourceA
ReadFile
WriteFile
LockResource
LocalFree
FormatMessageA
GetComputerNameA
GetFullPathNameA
GetCommandLineA
GetVersion
SetLastError
GetTickCount
OpenProcess
TerminateProcess
GetCurrentProcess
GetLastError
CloseHandle
GetModuleHandleA
GetProcAddress
CreateFileA
DeleteFileA
HeapFree
GetModuleFileNameA
UnhandledExceptionFilter
HeapAlloc
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
FlushFileBuffers
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetConsoleMode
GetCPInfo
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
RtlUnwind
SetStdHandle
SetFilePointer
SetEndOfFile
GetACP
GetOEMCP
LoadLibraryA
LCMapStringA
LCMapStringW
ReadConsoleInputA
SetConsoleMode
advapi32
OpenServiceA
DeleteService
StartServiceA
QueryServiceStatus
CreateServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenSCManagerA
ControlService
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.heb Size: - Virtual size: 1B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE