Static task
static1
Behavioral task
behavioral1
Sample
b8e2370ad8f2101124fb12e382ef6b87_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b8e2370ad8f2101124fb12e382ef6b87_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b8e2370ad8f2101124fb12e382ef6b87_JaffaCakes118
-
Size
97KB
-
MD5
b8e2370ad8f2101124fb12e382ef6b87
-
SHA1
ec556d6a9b52aa33247da2e629153d924974cc2c
-
SHA256
614fad4522fc1e84eaebd7a31238eca02f40a226540f6f10c2af95e00c898c06
-
SHA512
656656148dadefd2e2f8a2d5b47500d2e6903e62b5ec4390ae6de5eeea365d64727e7c3c192c1ec21fc13dc331ec824fb351bd24eaf70e8234d732166d5a4d2d
-
SSDEEP
1536:/bbFhigJ6BW98QpgE0gqe+90PsjSqBCPl7vworglftu1p8roNOo4R:/fXigJrJ5100Zqk7Yormlu1p8rL1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8e2370ad8f2101124fb12e382ef6b87_JaffaCakes118
Files
-
b8e2370ad8f2101124fb12e382ef6b87_JaffaCakes118.exe windows:4 windows x86 arch:x86
82fd4780815eb236388ba558b0ae27b1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
GetFileAttributesExA
DuplicateHandle
GetCurrentProcess
WriteFile
GetStartupInfoA
GetModuleHandleA
CreateFileA
GetModuleFileNameA
WinExec
GetLastError
GetProcAddress
GetSystemDirectoryA
GetVersionExA
CloseHandle
Sleep
LoadLibraryA
SetFileTime
user32
DispatchMessageA
ShowWindow
TranslateMessage
RegisterClassExA
GetMessageA
GetDesktopWindow
CreateWindowExA
DefWindowProcA
PostQuitMessage
advapi32
OpenServiceA
RegCloseKey
CreateServiceA
OpenSCManagerA
CloseServiceHandle
RegOpenKeyExA
StartServiceA
DeleteService
ConvertSidToStringSidA
LookupAccountNameA
GetUserNameA
RegQueryValueExA
dbghelp
ImageNtHeader
msvcrt
exit
_stricmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
sprintf
rand
??3@YAXPAX@Z
??2@YAPAXI@Z
_access
fclose
fflush
fwrite
fopen
srand
time
_except_handler3
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
shlwapi
SHDeleteKeyA
SHSetValueA
Sections
.text Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 108KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mdata Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
edata Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cdata Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
idata Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ