Static task
static1
Behavioral task
behavioral1
Sample
bc8dbe8c6102c2b23c6ecd15e53dda15_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bc8dbe8c6102c2b23c6ecd15e53dda15_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bc8dbe8c6102c2b23c6ecd15e53dda15_JaffaCakes118
-
Size
80KB
-
MD5
bc8dbe8c6102c2b23c6ecd15e53dda15
-
SHA1
8303b9a56b39e99ba0dc7ff7d17abd5639ceca4f
-
SHA256
43b68cf9d7d5cfd98f69ac6afe968b8bbfd78f4236847699fb4bd65048d3922e
-
SHA512
5eb1a6de44d10e42e384d8ef39846d329e7a8a5e117d99844e003afaed127bac501cc0fe8a0dedbace065b3a019666a8115443c8d3aab0ff3f33253f871d7ce2
-
SSDEEP
1536:+kHO9N4YskxtjZffENoBG89U4+659z9DeyqWqV5UoTOJOT:jfkvhUkE4D59zdeyql5UoTOJOT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc8dbe8c6102c2b23c6ecd15e53dda15_JaffaCakes118
Files
-
bc8dbe8c6102c2b23c6ecd15e53dda15_JaffaCakes118.exe windows:4 windows x86 arch:x86
22f0ed5516b18c153caa22f5c4600333
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileA
SetFileAttributesA
GetSystemDirectoryA
GetModuleFileNameA
GetProcAddress
LoadLibraryA
Sleep
DeleteFileA
TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
GetVersionExA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
CreateFileA
SetStdHandle
SetConsoleCtrlHandler
RtlUnwind
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapAlloc
ReadFile
GetFileType
SetHandleCount
GetLastError
MoveFileA
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
SetFilePointer
GetCurrentProcess
FlushFileBuffers
SetEndOfFile
user32
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
TranslateMessage
RegisterClassExA
LoadCursorA
LoadIconA
SetTimer
DispatchMessageA
LoadStringA
DefWindowProcA
CreateWindowExA
ShowWindow
UpdateWindow
shell32
ShellExecuteA
wsock32
send
recv
connect
htons
closesocket
gethostbyname
ioctlsocket
socket
WSACleanup
WSAStartup
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ