Static task
static1
Behavioral task
behavioral1
Sample
c07703fdbd6f28170d14c161e36afa78_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
c07703fdbd6f28170d14c161e36afa78_JaffaCakes118
-
Size
900KB
-
MD5
c07703fdbd6f28170d14c161e36afa78
-
SHA1
892ea24762c7de944cba5ba6ad932857f1af3dc9
-
SHA256
0f3de343deb56a03ad189c1804715fcf05e9759fde855e794a35f13a27acc44d
-
SHA512
9290cf33b8d4ce54a29dec584667d418b6c107e29fdcc7aa5acecf25592c9e56695db94384d8fa22cf3f1802ba9049d1c0bae5043af2c2a7765df83493b71093
-
SSDEEP
12288:HYxX617rfFUcGix32CaCUVkA2WlhoUH71W2brO2OZAg6LqT0nojHqUEhpyHKMdNt:yX617rfECa0QVbrKZJFT0CHNEYKMdNt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c07703fdbd6f28170d14c161e36afa78_JaffaCakes118
Files
-
c07703fdbd6f28170d14c161e36afa78_JaffaCakes118.exe windows:5 windows x86 arch:x86
38e74508dcf6ebce73276230d99b1ab7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
SetEvent
Sleep
lstrlenW
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
EnterCriticalSection
CreateProcessW
TerminateProcess
LeaveCriticalSection
InitializeCriticalSection
GetTickCount
GetCurrentThreadId
CreateThread
WaitForMultipleObjects
GetLastError
CreateFileW
WriteFile
DeleteFileW
MultiByteToWideChar
GetEnvironmentVariableW
lstrlenA
RaiseException
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
DeleteCriticalSection
CreateEventW
OpenEventW
ExitProcess
GetCurrentThread
WaitForSingleObject
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SleepEx
SetLastError
ReadFile
PeekNamedPipe
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
FormatMessageW
CreateFileA
GetStartupInfoW
GetSystemTimeAsFileTime
ExitThread
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
SetFilePointer
FindClose
GetDriveTypeA
FindFirstFileA
GetModuleHandleW
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetModuleHandleA
FlushFileBuffers
SetStdHandle
GetFullPathNameA
GetCurrentDirectoryA
advapi32
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
ole32
CoGetClassObject
OleInitialize
oleaut32
VariantInit
VariantClear
SysAllocString
SysFreeString
SysAllocStringByteLen
VariantChangeType
SysStringByteLen
shlwapi
PathAppendW
ws2_32
ioctlsocket
WSAAddressToStringA
socket
select
listen
__WSAFDIsSet
WSACleanup
WSAStartup
closesocket
WSAGetLastError
recv
send
getsockname
ntohs
bind
htons
getsockopt
getpeername
setsockopt
connect
WSASetLastError
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
gethostname
wldap32
ord14
ord118
ord208
ord145
ord216
ord26
ord46
ord41
ord27
ord301
ord167
ord147
ord79
ord142
ord127
ord133
Sections
.text Size: 492KB - Virtual size: 492KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE