Static task
static1
Behavioral task
behavioral1
Sample
d1029195878744ea88428276573dd591_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d1029195878744ea88428276573dd591_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d1029195878744ea88428276573dd591_JaffaCakes118
-
Size
50KB
-
MD5
d1029195878744ea88428276573dd591
-
SHA1
01d7d69bd2dcdceebfb30c7f087fa98e4f108fdc
-
SHA256
8e868b4dd71d8d1ed1e01b28060032e95ee88ab915669b080b573e0f88c9a77e
-
SHA512
8f592cd722f015b646511eafb992030a4a12a72650d858db4a09be541edbd3fdda57a6892d3cf72d679591271b51263c26fd0aab298239cd770ecf64ad6e86de
-
SSDEEP
768:y4BUqrVHEPih6wCOKApq/kt7EPtfrTCyHHhYRhblRk7Al2EbAy6c+kChFK6JTXqR:y4mqrVW1zu7Eh7HXCH6VkChBexheCsq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1029195878744ea88428276573dd591_JaffaCakes118
Files
-
d1029195878744ea88428276573dd591_JaffaCakes118.exe windows:1 windows x86 arch:x86
5898d8b74a596cff3f24b0fca836a5fa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetFolderPathA
ShellExecuteEx
ws2_32
htons
gethostname
gethostbyname
connect
closesocket
WSAStartup
WSACleanup
send
socket
WSAIoctl
advapi32
RegEnumKeyExA
StartServiceA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
OpenSCManagerA
OpenProcessToken
LookupPrivilegeValueA
GetUserNameA
DeleteService
CreateServiceA
CloseServiceHandle
AdjustTokenPrivileges
crypt32
CryptUnprotectData
gdi32
GetDeviceCaps
kernel32
Sleep
SetProcessPriorityBoost
WideCharToMultiByte
UnmapViewOfFile
lstrlenW
CloseHandle
lstrlen
lstrcpyn
lstrcpy
lstrcmpi
lstrcmp
lstrcat
SetPriorityClass
SetErrorMode
OpenProcess
MultiByteToWideChar
MapViewOfFile
LocalFree
LocalAlloc
LoadLibraryA
GlobalMemoryStatus
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetTickCount
GetTempPathA
GetSystemDirectoryA
GetShortPathNameA
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetModuleFileNameA
GetLogicalDrives
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceA
GetCurrentProcess
GetCurrentDirectoryA
GetComputerNameA
FindNextFileA
FindFirstFileA
FindClose
ExpandEnvironmentStringsA
ExitProcess
DeleteFileA
CreateThread
CreateFileMappingA
CreateFileA
CopyFileA
WriteFile
ole32
CreateStreamOnHGlobal
CoTaskMemFree
psapi
GetModuleFileNameExA
EnumProcesses
EnumProcessModules
rasapi32
RasGetEntryPropertiesA
RasGetEntryDialParamsA
RasEnumEntriesA
shlwapi
StrChrA
PathFileExistsA
StrStrIA
StrRChrA
StrCmpNA
user32
GetDlgCtrlID
ReleaseDC
GetDC
FindWindowExA
SetActiveWindow
wsprintfA
FindWindowA
SendMessageA
wininet
InternetGetConnectedState
Sections
.text Size: 32KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
google.r Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ