Static task
static1
Behavioral task
behavioral1
Sample
bc558dad3ce833801f048a7cc007a556_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bc558dad3ce833801f048a7cc007a556_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bc558dad3ce833801f048a7cc007a556_JaffaCakes118
-
Size
46KB
-
MD5
bc558dad3ce833801f048a7cc007a556
-
SHA1
83eb3de5976ed83a2635905fd66cad97743c88e3
-
SHA256
38518301129a6618783b6d0bdbac5e1533126d160f02b02405f634f0740dd1ed
-
SHA512
162673b69cfc2c7e51df27f16b2cf71ec1ba3b72a158dbb161062802444d4da56f4fb95694dc0ac36cbf7ee6600571c7af721d0ff28b41c872da60ad4e8686c2
-
SSDEEP
768:Yz1wV+XS+k9ylkrzLMQIjQExSO4+FDtL2lw7z3Fj9wbPk54ZJ4Pny9n:Yyx9mkr0G+hGYVj9wbcqZePy9n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc558dad3ce833801f048a7cc007a556_JaffaCakes118
Files
-
bc558dad3ce833801f048a7cc007a556_JaffaCakes118.exe windows:5 windows x86 arch:x86
20e41ce01f80755f4eea7fc12deb3017
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
ZwReadFile
ZwQueryInformationFile
strrchr
ZwCreateFile
ZwWriteFile
ZwQueryVolumeInformationFile
ZwQueryDirectoryFile
wcslen
ZwSetInformationFile
RtlAdjustPrivilege
RtlIpv4StringToAddressA
ZwOpenThreadTokenEx
_wcsicmp
strcmp
strcpy
sprintf
memcmp
strchr
ZwSetSecurityObject
LdrAccessResource
wcsrchr
swprintf
strlen
RtlDestroyQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlCreateQueryDebugBuffer
RtlEqualUnicodeString
ZwQuerySystemInformation
ZwSuspendThread
ZwQueryInformationThread
ZwOpenThread
_stricmp
RtlNtStatusToDosError
RtlIpv4AddressToStringA
ZwClose
ZwEnumerateKey
ZwOpenKey
ZwQueryKey
ZwResumeThread
ZwLoadDriver
ZwCreateSymbolicLinkObject
ZwUnmapViewOfSection
ZwFlushVirtualMemory
RtlImageNtHeader
ZwMapViewOfSection
ZwCreateSection
ZwFsControlFile
ZwOpenFile
ZwSetValueKey
ZwCreateKey
LdrFindResource_U
RtlInitUnicodeString
ZwAdjustPrivilegesToken
memset
RtlIpv4StringToAddressW
ZwQueryValueKey
ZwImpersonateThread
memcpy
kernel32
DeleteTimerQueueTimer
Sleep
GetVersion
ExitProcess
GetTickCount
CreateTimerQueueTimer
VirtualAlloc
GetSystemTimeAsFileTime
GetLastError
BindIoCompletionCallback
LocalFree
LocalAlloc
advapi32
MD5Update
MD5Final
MD5Init
ws2_32
WSACleanup
WSARecvFrom
WSASendTo
setsockopt
WSASend
WSARecv
WSAIoctl
bind
closesocket
WSAGetLastError
WSASocketW
WSAStartup
cabinet
ord20
ord22
ord23
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 432B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ