Static task
static1
Behavioral task
behavioral1
Sample
cfbd6acdba141977fb47cce32ae98884_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cfbd6acdba141977fb47cce32ae98884_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
cfbd6acdba141977fb47cce32ae98884_JaffaCakes118
-
Size
259KB
-
MD5
cfbd6acdba141977fb47cce32ae98884
-
SHA1
a7d4dd510f168dc701289cb096dfd76354b26d24
-
SHA256
6bf2f07a411af979a432042cb921bc0989b16f8460a010dbd7cc414b0df1afc3
-
SHA512
faa305b863303f7866c252980dc75b0850a0c552307a9695d0abe7dbb96ddb74b2779d1f4506d76f47505ea8226b15c1597c055ecd6524dc37fe45ba119a641a
-
SSDEEP
6144:i6sLroZp1rpq8SqIgyt9xAqPTEyMbZgpu87GE7ifK+:iBroiKI/fpTEZg02Wj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cfbd6acdba141977fb47cce32ae98884_JaffaCakes118
Files
-
cfbd6acdba141977fb47cce32ae98884_JaffaCakes118.exe windows:4 windows x86 arch:x86
6aab68ac1399d8e9fba0f351ef5fa357
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
gethostbyname
ntohs
WSAGetLastError
WSAStartup
WSACleanup
gethostbyaddr
inet_ntoa
inet_addr
iphlpapi
SendARP
kernel32
lstrlenW
lstrlenA
SystemTimeToFileTime
GetLocalTime
CreateEventA
WaitForSingleObject
GetExitCodeThread
WaitForMultipleObjects
FreeLibrary
OpenMutexA
GetCurrentThreadId
CreateSemaphoreA
OpenEventA
OpenSemaphoreA
GetModuleHandleA
FileTimeToSystemTime
GetSystemTime
FindResourceA
LoadResource
RaiseException
GetThreadLocale
GetACP
GetProcessHeap
CreateMutexA
lstrcmpA
GetProcAddress
advapi32
CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
RegCreateKeyExA
RegSetValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGetProvParam
CryptDeriveKey
CryptGetHashParam
ole32
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysStringByteLen
VariantInit
VarBstrCmp
SysStringLen
SysFreeString
SysAllocString
VariantClear
quartz
AMGetErrorTextW
DllCanUnloadNow
DllUnregisterServer
DBToAmpFactor
DllGetClassObject
AMGetErrorTextA
wship6
WSHGetSocketInformation
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VI Size: 1024B - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ep Size: 2KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.IG Size: 101KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SJWMGu Size: 4KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zTqxuS Size: 5KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qwsfZ Size: 113KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.T Size: 1024B - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ