Static task
static1
Behavioral task
behavioral1
Sample
d169b87de270b0bf3babacef0cfd2e7c_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d169b87de270b0bf3babacef0cfd2e7c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d169b87de270b0bf3babacef0cfd2e7c_JaffaCakes118
-
Size
994KB
-
MD5
d169b87de270b0bf3babacef0cfd2e7c
-
SHA1
b77d51b7d19d8f61b6f7d52534bbdff12196d426
-
SHA256
ac528ff79cffca7d9345a55f1bd23237c403ddc7d5f350d4452632c93255587d
-
SHA512
b557074e3c67c9d4e7a0a5bd41e4309dd5ece609164015cce8fc4d86ebdc0d6e840d44690d454e7efe339c2acf4427642eed13e2df3e7b461b93bff5deb4d8ba
-
SSDEEP
24576:LW/KHp/a5XwE6WSa6TtzzgCY7rnyypjAfuDOvkkaVY3QjdU0/yjS/yTIImhEDMff:L7C5XwEma65zYJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d169b87de270b0bf3babacef0cfd2e7c_JaffaCakes118
Files
-
d169b87de270b0bf3babacef0cfd2e7c_JaffaCakes118.exe windows:4 windows x86 arch:x86
6656f65d8e1a56a7ac419f8a74c489fe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegSetValueExA
kernel32
CopyFileA
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WideCharToMultiByte
msvcrt
_fdopen
_read
_strdup
_write
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_filbuf
_filelengthi64
_flsbuf
_iob
_lseeki64
_onexit
_setmode
abort
atexit
fclose
fflush
fgetpos
fopen
fputc
fputs
fread
free
fsetpos
fwrite
getwc
iswctype
malloc
memchr
memcpy
memmove
memset
putwc
realloc
setlocale
setvbuf
signal
sscanf
strcat
strcmp
strcoll
strcpy
strftime
strlen
strtod
strxfrm
towlower
towupper
ungetc
ungetwc
wcscoll
wcsftime
wcslen
wcsxfrm
user32
MessageBoxA
wsock32
WSAStartup
connect
gethostbyname
htons
send
socket
Sections
.text Size: 499KB - Virtual size: 499KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
/4 Size: 512B - Virtual size: 32B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/19 Size: 512B - Virtual size: 102B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/35 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/47 Size: 1024B - Virtual size: 556B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/61 Size: 1024B - Virtual size: 580B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/73 Size: 512B - Virtual size: 220B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/86 Size: 512B - Virtual size: 16B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/97 Size: 1024B - Virtual size: 548B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/108 Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ