Static task
static1
Behavioral task
behavioral1
Sample
d2f8b0babb6a9e9d8a2eab4675a8fd77_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2f8b0babb6a9e9d8a2eab4675a8fd77_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d2f8b0babb6a9e9d8a2eab4675a8fd77_JaffaCakes118
-
Size
55KB
-
MD5
d2f8b0babb6a9e9d8a2eab4675a8fd77
-
SHA1
885d8f38170399ab244a1a05062f9e08e793ce62
-
SHA256
dde215835a6dfc1be0c2629b26c7bf2225080a7b6319b78e375a5b3b1e8e7c14
-
SHA512
712aec316626e7bf43ec6c118084149a029c03c4d5bb2468edf2cbe344a3bbcbd5868f97f38a94738cf4779f7181334fa196dc828cb024be888a9f24aea1488f
-
SSDEEP
768:CR+9TrRY5oVaEesWNqQOGtuTL3DMIZzp6I+i8X:niu2NhOGKLTQX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2f8b0babb6a9e9d8a2eab4675a8fd77_JaffaCakes118
Files
-
d2f8b0babb6a9e9d8a2eab4675a8fd77_JaffaCakes118.exe windows:4 windows x86 arch:x86
914cc02509bc94bc67c351412248605c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
AddAtomA
CloseHandle
CreatePipe
CreateProcessA
CreateThread
DisconnectNamedPipe
DuplicateHandle
ExitProcess
ExitThread
FindAtomA
FreeConsole
GetAtomNameA
GetCurrentProcess
GetLastError
GetStdHandle
PeekNamedPipe
ReadFile
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
WaitForMultipleObjects
WriteFile
msvcrt
_close
_dup
_itoa
_kbhit
_open
_read
_strcmpi
_strnicmp
_write
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_iob
_isatty
_onexit
_setjmp
_setmode
_sleep
abort
atexit
atoi
exit
fflush
fprintf
free
getenv
gets
longjmp
malloc
memcmp
memcpy
memset
rand
signal
sprintf
srand
strcat
strchr
strcmp
strcpy
strlen
strncmp
strncpy
time
ws2_32
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getservbyname
getservbyport
getsockname
htons
inet_addr
inet_ntoa
listen
ntohs
recv
recvfrom
select
send
setsockopt
shutdown
socket
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 576B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE