Static task
static1
Behavioral task
behavioral1
Sample
bc7e18852dffc323ef51ab28354e4683_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bc7e18852dffc323ef51ab28354e4683_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bc7e18852dffc323ef51ab28354e4683_JaffaCakes118
-
Size
83KB
-
MD5
bc7e18852dffc323ef51ab28354e4683
-
SHA1
98d7bd76f1db686b4fc2f47283a61a7d2b02589f
-
SHA256
fe46727c97397b976baa5899c3d7b910e8b848b53760cd8acd8642fa3b44ddf0
-
SHA512
783ec039187837fe3f514958bd634058a441921ac5ab80fecdee68f1236fa6dad8b6474f4c0ce57b087a58621430549cd720c4013538213c456804449d3559e8
-
SSDEEP
1536:5SoO9HHw3hLYTj7wLK9tKNjfG9OUwzqNKkJyyc+WBSaoYAHdRpMfX2Ru:5SoO9nw3hLYTYLK9tEbHUnsY5WQ2ATK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc7e18852dffc323ef51ab28354e4683_JaffaCakes118
Files
-
bc7e18852dffc323ef51ab28354e4683_JaffaCakes118.exe windows:4 windows x86 arch:x86
587d772e68ad005efca1637380a140fe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
HeapFree
lstrcmpA
FindClose
FindNextFileA
UnmapViewOfFile
Sleep
FindFirstFileA
lstrcpyA
FreeLibrary
VirtualAlloc
GetProcAddress
LoadLibraryA
GetVersionExA
CreateThread
lstrcatA
GetFileSize
GetCurrentProcess
CreateProcessA
WriteFile
LockResource
LoadResource
FindResourceA
CopyFileA
GetSystemDirectoryA
ExpandEnvironmentStringsA
GlobalMemoryStatus
GetSystemTime
HeapAlloc
GetModuleHandleA
GetVersion
GetEnvironmentVariableA
CloseHandle
CreateFileA
GetProcessHeap
CreateFileMappingA
MapViewOfFileEx
GetModuleFileNameA
SetPriorityClass
GetCurrentProcessId
ExitProcess
TerminateProcess
user32
wsprintfA
advapi32
RegSetValueExA
RegFlushKey
RegCreateKeyA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
GetUserNameA
ws2_32
bind
connect
htons
inet_addr
gethostbyname
socket
inet_ntoa
recv
listen
send
htonl
WSAGetLastError
__WSAFDIsSet
select
ioctlsocket
WSAStartup
closesocket
accept
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ