Static task
static1
Behavioral task
behavioral1
Sample
c0da8f3bbfadf151e9d962a6518d280f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c0da8f3bbfadf151e9d962a6518d280f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c0da8f3bbfadf151e9d962a6518d280f_JaffaCakes118
-
Size
15KB
-
MD5
c0da8f3bbfadf151e9d962a6518d280f
-
SHA1
5966c27a19e973be9f3418ff07e14c1edbaa84f4
-
SHA256
bff9fa484ccb4727cf4bc2424aa57411893d4dd509683a77d9ff981181ccf4d0
-
SHA512
fee25eb9a4bd621e0acb1c4b76d414c267e94048b0796558b9080565fbac1accbf7618480e30738b95a5906a1e3419153fa38efb180e1d488460a09c7a3e0633
-
SSDEEP
384:hSOk4dU8s+lFz8vRdRF3m3Rqyb3sZtlbEX:hK4C8sqAX56Nbcu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0da8f3bbfadf151e9d962a6518d280f_JaffaCakes118
Files
-
c0da8f3bbfadf151e9d962a6518d280f_JaffaCakes118.exe windows:4 windows x86 arch:x86
87d22617a5cf30e4b7e1b3554f1d859b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord540
ord2846
ord2818
ord537
ord2764
ord6648
ord4129
ord800
ord2915
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
printf
rand
srand
time
_XcptFilter
_exit
_except_handler3
__CxxFrameHandler
strncmp
atoi
strstr
strchr
sprintf
exit
kernel32
GlobalMemoryStatus
GetVersionExA
WaitForSingleObject
ResumeThread
GetEnvironmentVariableA
lstrcatA
GetStartupInfoA
GetModuleHandleA
GetLastError
lstrlenA
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
lstrcpyA
GetModuleFileNameA
ExitThread
Sleep
GetCurrentProcessId
GetTickCount
HeapAlloc
GetProcessHeap
CreateProcessA
GetSystemDirectoryA
CreateThread
GetShortPathNameA
user32
wsprintfA
advapi32
StartServiceA
OpenServiceA
OpenSCManagerA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegOpenKeyExA
RegCloseKey
CloseServiceHandle
RegSetValueExA
CreateServiceA
DeleteService
RegOpenKeyA
ws2_32
send
sendto
setsockopt
WSASocketA
inet_addr
htons
WSAStartup
gethostbyname
gethostname
htonl
select
connect
socket
inet_ntoa
closesocket
WSAGetLastError
recv
__WSAFDIsSet
urlmon
URLDownloadToFileA
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xiaohui Size: 6B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ