Static task
static1
Behavioral task
behavioral1
Sample
c2ab5965bb9bc839d349e4ab25b7d51e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c2ab5965bb9bc839d349e4ab25b7d51e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c2ab5965bb9bc839d349e4ab25b7d51e_JaffaCakes118
-
Size
58KB
-
MD5
c2ab5965bb9bc839d349e4ab25b7d51e
-
SHA1
78b27dd2748aba4faea53d1fe404c15fa7b790f1
-
SHA256
ef8187b423475a3ae735258981f11d6055738320ffadfb8cd6ef4ca9ee806b2d
-
SHA512
c8831b4a85ac11020490e4b4a4d64a16a0948aa29687702475e429254aac49040742bacfbfa2addaefdc7e3dfbb21d0274dd990f55f5d88a2b01f50e3ad0453f
-
SSDEEP
768:eSD95tA1a9L2FzEO5XZd8t7mlgLoUjigvaoMvaLPzPPrHDtzk6M678TgNJ:eSR5Aa9L2FzEO5XZ4MmtvbrXNw6ai
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c2ab5965bb9bc839d349e4ab25b7d51e_JaffaCakes118
Files
-
c2ab5965bb9bc839d349e4ab25b7d51e_JaffaCakes118.exe windows:4 windows x86 arch:x86
bd20bc5fca6f0c44ea9808ceaa365bf8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetOEMCP
OpenProcess
Sleep
MoveFileExA
GetTempPathA
CreateProcessA
SetProcessWorkingSetSize
WaitForSingleObject
GetShortPathNameA
WinExec
GetProcessId
GetTempFileNameA
GetBinaryTypeA
CloseHandle
RtlMoveMemory
GetModuleHandleA
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
ReadFile
SetFilePointer
GetFileSize
CreateFileA
RtlFillMemory
HeapAlloc
GetProcessHeap
GetModuleFileNameA
IsDebuggerPresent
DeleteFileA
lstrlen
CreateMutexA
OpenMutexA
lstrcpynA
shlwapi
PathFileExistsA
PathFindFileNameA
PathRemoveFileSpecA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyA
user32
wvsprintfA
FindWindowA
PostMessageA
ShowWindow
WaitForInputIdle
wsprintfA
MessageBoxA
GetWindowTextA
EnumChildWindows
GetAncestor
GetWindowThreadProcessId
EnumWindows
psapi
GetModuleFileNameExA
EnumProcesses
urlmon
URLDownloadToFileA
shell32
ShellExecuteEx
SHGetSpecialFolderPathA
SHFileOperationA
wininet
InternetOpenA
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
iphlpapi
GetAdaptersInfo
msvcrt
_strnicmp
malloc
free
memmove
modf
strchr
_ftol
atoi
_CIfmod
??3@YAXPAX@Z
strncmp
strncpy
rand
srand
tolower
sprintf
Sections
.text Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE