Static task
static1
Behavioral task
behavioral1
Sample
cf2e36e934821c231cb09d2f453fd603_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
cf2e36e934821c231cb09d2f453fd603_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
cf2e36e934821c231cb09d2f453fd603_JaffaCakes118
-
Size
68KB
-
MD5
cf2e36e934821c231cb09d2f453fd603
-
SHA1
43940dd058885eafe70e6917eb30e9867d4a130f
-
SHA256
149816b3ac159ae39da7736ac4f970b961b6108677476c95468c8f68dd0e9083
-
SHA512
b8733d68783f758cbe61d21c83e5fd8bf6e7a81c2e63273229d2dcc519b7c72a8c173b797e5e8982634b45d20076ed46985b3fbb156594c681dea186b2978b3a
-
SSDEEP
768:VGsWXGO9vIS0z/+LWmV79kXW7VZYmXZySvYtiB9d57MCwlDoYSy:VGsWH99BSebYOFb+o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cf2e36e934821c231cb09d2f453fd603_JaffaCakes118
Files
-
cf2e36e934821c231cb09d2f453fd603_JaffaCakes118.exe windows:4 windows x86 arch:x86
43ff38ffcb45382b7f8bab3a9348d128
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetDriveTypeA
GetProcAddress
LoadLibraryA
TerminateProcess
CreateProcessA
GetCurrentProcess
FindClose
FindNextFileA
FindFirstFileA
FileTimeToDosDateTime
FileTimeToLocalFileTime
SearchPathA
OpenProcess
GetLastError
_llseek
OpenFile
_hwrite
CopyFileA
SetCurrentDirectoryA
CreateDirectoryA
WriteProcessMemory
GetModuleHandleA
CloseHandle
DeleteFileA
VirtualQueryEx
GetDiskFreeSpaceA
GetVersionExA
GetSystemDirectoryA
GlobalMemoryStatus
Sleep
CreateThread
GetComputerNameA
_hread
_lclose
GetSystemTime
GetCommandLineA
GetEnvironmentStrings
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
LCMapStringW
HeapReAlloc
VirtualAlloc
HeapAlloc
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileType
CreateFileA
RemoveDirectoryA
GetStartupInfoA
SetHandleCount
GetVersion
ExitProcess
HeapFree
SetStdHandle
GetStdHandle
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
user32
ExitWindowsEx
advapi32
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetUserNameA
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyA
ws2_32
setsockopt
inet_addr
select
recv
WSAStartup
bind
listen
accept
shutdown
WSAGetLastError
send
htons
connect
closesocket
gethostbyname
inet_ntoa
socket
wininet
InternetGetConnectedState
Sections
.text Size: 52KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE