Static task
static1
Behavioral task
behavioral1
Sample
ce46ca9d40fe564c4824c112c2b04f1f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ce46ca9d40fe564c4824c112c2b04f1f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ce46ca9d40fe564c4824c112c2b04f1f_JaffaCakes118
-
Size
44KB
-
MD5
ce46ca9d40fe564c4824c112c2b04f1f
-
SHA1
40dd48c85c7f9fc73bf297d23cd19b3acaaa0da6
-
SHA256
fc2deb1022387e98b6b6649a3beafd2499907486b3084a0c698d36ba12807f9d
-
SHA512
329c0bea642ce79799d27ea97621f6a34876aa983db31761dbcd6e841addcf1d4acf68d80297d40cdeeaebf163f65d8310fae7beca6d2fd14987e493ad3fd4c2
-
SSDEEP
768:bVDpW9Iimtdns8g9xzIC4sMspWKR+eCr0nmkrO2rqK0o2r:+IuMsMspW1eCwm8h90o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce46ca9d40fe564c4824c112c2b04f1f_JaffaCakes118
Files
-
ce46ca9d40fe564c4824c112c2b04f1f_JaffaCakes118.exe windows:4 windows x86 arch:x86
02c00de0a61c2154092609425ff97cf7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
GetSystemDirectoryA
Sleep
CreateFileA
WriteFile
MoveFileExA
GetWindowsDirectoryA
CloseHandle
CompareStringW
CompareStringA
GetTimeZoneInformation
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FlushFileBuffers
LCMapStringW
LCMapStringA
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
GetLastError
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
ReadFile
SetStdHandle
SetEnvironmentVariableA
advapi32
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegOpenKeyA
shell32
ShellExecuteA
wsock32
send
recv
gethostbyname
socket
closesocket
connect
__WSAFDIsSet
getsockopt
WSAStartup
select
htons
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE