Static task
static1
Behavioral task
behavioral1
Sample
bea1f6350a5cad26360921312e385947_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bea1f6350a5cad26360921312e385947_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bea1f6350a5cad26360921312e385947_JaffaCakes118
-
Size
188KB
-
MD5
bea1f6350a5cad26360921312e385947
-
SHA1
58ad526924f9d38a9e7d209236d6d7c42563689c
-
SHA256
4d9b836b3ea2e90893e88a946e4fd82ec6079e4197e6f259540b04f6ab729dde
-
SHA512
f5db2a55747a25a27def5c12c71ddd8770af45fe2b7c06ed181fa7890149345025afc407caee2d6984cf9ea0b1db1dc429a69421d3f1b0d46390664337bfcd3e
-
SSDEEP
1536:O8p70ShI+CKNWgRKHZkhM1veXFe1KNZHcYcowXDtPzTG9iuolIPh2:jzI+ZNrROuMaFe10NkDRTG/oePc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bea1f6350a5cad26360921312e385947_JaffaCakes118
Files
-
bea1f6350a5cad26360921312e385947_JaffaCakes118.exe windows:4 windows x86 arch:x86
b5ddda9ec2d24c403c01b9d8e240b827
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileType
Sleep
HeapAlloc
GetStartupInfoA
SetEndOfFile
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
CreateFileA
ReadFile
SetFilePointer
ExitProcess
TerminateProcess
GetCurrentProcess
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
SetHandleCount
GetTickCount
SetStdHandle
UnhandledExceptionFilter
HeapReAlloc
HeapFree
GetLastError
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
CloseHandle
FlushFileBuffers
GetEnvironmentStringsW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
RtlUnwind
SetConsoleCtrlHandler
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
wsock32
ioctlsocket
htons
WSAStartup
socket
connect
WSAGetLastError
recv
send
shutdown
closesocket
Sections
.text Size: 152KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ