Static task
static1
Behavioral task
behavioral1
Sample
bd1410fa2f46fef77f6f7e1351ea6c19_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bd1410fa2f46fef77f6f7e1351ea6c19_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bd1410fa2f46fef77f6f7e1351ea6c19_JaffaCakes118
-
Size
84KB
-
MD5
bd1410fa2f46fef77f6f7e1351ea6c19
-
SHA1
7ffb711dfd355c690cb3c4dff9b4a0c24e9b8619
-
SHA256
ca758f7155e5967ed61a6dd0c5d82d4f2d277b7c9f15bcef0238beb13112111e
-
SHA512
5b70eb902788b2a539ce5dc83bfbf79e8ccbdaa8d6d518e6a29c3edc5e73851bbbb28129859bf6ab5610406e0bdd4b9a6aacc0c57997c6fd4a0e9bc7c24b1fcb
-
SSDEEP
1536:OcT5IWsaGb/maZzUp3j1cQ9zBRAY8foJs:Z5IWsJ/maZzeT1ptSrfoJs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd1410fa2f46fef77f6f7e1351ea6c19_JaffaCakes118
Files
-
bd1410fa2f46fef77f6f7e1351ea6c19_JaffaCakes118.exe windows:4 windows x86 arch:x86
fa3f5739f6c86b6aaea16480b458a142
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVolumeInformationA
GetComputerNameA
TerminateProcess
OutputDebugStringA
GetLastError
CreateMutexA
DeleteFileA
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceExA
OpenFile
WaitForSingleObject
CreateThread
GetModuleFileNameA
FindClose
FindNextFileA
FindFirstFileA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetEndOfFile
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
CreateProcessA
Sleep
GetLocalTime
lstrlenA
CreateFileA
FlushFileBuffers
SetStdHandle
SetFilePointer
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
SetEnvironmentVariableA
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetProcAddress
GetCurrentProcess
HeapFree
HeapAlloc
HeapReAlloc
GetTimeZoneInformation
GetSystemTime
GetFileAttributesA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
CloseHandle
WriteFile
ReadFile
WideCharToMultiByte
user32
EnumChildWindows
GetWindowThreadProcessId
GetClassNameA
GetParent
CloseDesktop
SetForegroundWindow
EnumDesktopWindows
PostMessageA
CreateDesktopA
OpenDesktopA
SendMessageA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
shell32
SHGetSpecialFolderPathA
ws2_32
WSAGetLastError
WSAStartup
connect
setsockopt
socket
htons
send
recv
closesocket
shutdown
gethostbyname
WSACleanup
inet_addr
Sections
.text Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 172KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ