Static task
static1
Behavioral task
behavioral1
Sample
cfb5091402851a49ae42f691b61ed2bb_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cfb5091402851a49ae42f691b61ed2bb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
cfb5091402851a49ae42f691b61ed2bb_JaffaCakes118
-
Size
180KB
-
MD5
cfb5091402851a49ae42f691b61ed2bb
-
SHA1
5c2671c7367eb57c6e2bf4ea26735acc535e55d6
-
SHA256
2bfb39a806ddfb3fe8509fb8c47d9986ff996cbe09818a40989daf8994c711a0
-
SHA512
7b0b12c1ba9c80487428038917870883aaf4f56532d7a89f26266ad64a75b373e7a7cffd03a6586d30997fa5ef012f369cf36ec5064ebe32f50fa91af0beec84
-
SSDEEP
1536:hBkIKQqIrnYvfrFI6edKCWlhveCOdeZSSg3KTqaApe2qmogfky32Y:hGIG4naTFsdKZ5eCOo7g6WaAl9o8X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cfb5091402851a49ae42f691b61ed2bb_JaffaCakes118
Files
-
cfb5091402851a49ae42f691b61ed2bb_JaffaCakes118.exe windows:4 windows x86 arch:x86
6b624d0fe7a27aee29511fb4b9250183
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalFree
GlobalAlloc
UnmapViewOfFile
lstrlenA
MapViewOfFile
CreateFileMappingA
SetFilePointer
WriteFile
CloseHandle
GetFileSize
CreateFileA
Sleep
ReadProcessMemory
OpenProcess
Module32Next
DeleteFileA
TerminateProcess
SetFileAttributesA
Module32First
CreateToolhelp32Snapshot
Process32Next
Process32First
GetModuleFileNameA
GetModuleHandleA
ReadFile
lstrcatA
GetTempPathA
lstrcpyA
CreateThread
GetTickCount
CreateProcessA
GetProcAddress
LoadLibraryA
FindClose
FindNextFileA
GetFullPathNameA
SetCurrentDirectoryA
FindFirstFileA
GetDriveTypeA
ExitThread
GetLocaleInfoA
GetLastError
CreateMutexA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetEndOfFile
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
SetStdHandle
SetEnvironmentVariableA
FlushFileBuffers
SetConsoleCtrlHandler
RtlUnwind
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetTimeZoneInformation
GetSystemTime
GetLocalTime
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetCommandLineA
GetVersion
ExitProcess
DebugBreak
GetStdHandle
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
SetHandleCount
GetFileType
GetStartupInfoA
GetCurrentProcess
HeapAlloc
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
user32
CharLowerA
wsprintfA
ws2_32
WSACleanup
gethostbyname
WSAStartup
connect
htons
bind
listen
accept
recv
closesocket
send
inet_addr
socket
inet_ntoa
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
Sections
.text Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ