Static task
static1
Behavioral task
behavioral1
Sample
beeab3a0114428374a4e1addc9115ba8_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
beeab3a0114428374a4e1addc9115ba8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
beeab3a0114428374a4e1addc9115ba8_JaffaCakes118
-
Size
2.8MB
-
MD5
beeab3a0114428374a4e1addc9115ba8
-
SHA1
5e46a8415b8878f99e7a7bc8288db273d5f287a0
-
SHA256
2f8c84dc3f296e0edc455f05260a5839af993250df02556ccd881aa6b04d7708
-
SHA512
0a7ffa4b083b16482b47025eb8b1d608b868b1f591f08acca87ad421d4fbffce10b5ccac54c5a469b62b14a7ab9a95e05d0712ec7689a4dd6571b79b9c00eaf0
-
SSDEEP
768:iNBJr0DhKZQsMyDUynleM3RQZ8widvD3bHYSyobM6vd56K:iT2qNMpUQMhU8pD3b4Syh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource beeab3a0114428374a4e1addc9115ba8_JaffaCakes118
Files
-
beeab3a0114428374a4e1addc9115ba8_JaffaCakes118.exe windows:1 windows x86 arch:x86
5ded618612757132417be3630adf1a03
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htons
inet_addr
recv
send
socket
gethostname
WSAAsyncSelect
closesocket
WSAStartup
WSACleanup
connect
kernel32
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FlushConsoleInputBuffer
FlushFileBuffers
GetCommandLineA
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetDiskFreeSpaceA
GetDriveTypeA
GetLastError
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetProcessHeap
GetStdHandle
GetTickCount
GetVolumeInformationA
GlobalMemoryStatus
HeapAlloc
LoadLibraryA
LocalAlloc
OpenProcess
Process32First
Process32Next
ReadConsoleA
CreateFileA
ReadConsoleOutputA
ReadConsoleOutputW
ReadConsoleW
ReadFile
RtlUnwind
ScrollConsoleScreenBufferA
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsoleTextAttribute
TerminateProcess
TerminateThread
CreatePipe
CreateProcessA
WriteConsoleA
WriteConsoleOutputA
WriteConsoleOutputW
WriteConsoleW
WriteFile
lstrlenA
lstrlenW
CreateThread
CreateToolhelp32Snapshot
user32
GetWindowTextA
GetParent
GetWindowThreadProcessId
LoadCursorA
LoadIconA
RegisterClassA
GetMessageA
TranslateMessage
DispatchMessageA
PostQuitMessage
EnumWindows
CreateWindowExA
DefWindowProcA
advapi32
LookupAccountSidA
LookupPrivilegeValueA
ChangeServiceConfigA
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
EnumServicesStatusExA
LockServiceDatabase
OpenSCManagerA
OpenServiceA
QueryServiceConfigA
QueryServiceConfig2A
QueryServiceStatus
QueryServiceStatusEx
StartServiceA
UnlockServiceDatabase
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
GetLengthSid
CopySid
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
GetCurrentHwProfileA
crtdll
__GetMainArgs
atoi
exit
free
malloc
memset
printf
raise
signal
sprintf
sscanf
strchr
strcmp
strcpy
strlen
strncmp
strrchr
strstr
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE