Static task
static1
Behavioral task
behavioral1
Sample
d64473c7932fbf935715be0c4d06332d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d64473c7932fbf935715be0c4d06332d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d64473c7932fbf935715be0c4d06332d_JaffaCakes118
-
Size
46KB
-
MD5
d64473c7932fbf935715be0c4d06332d
-
SHA1
92e35a7e79aae7cbb59feedb83f0582954278754
-
SHA256
ef943aa25bb8e140cb00d2e29850262f6716c09d94fec8a1e1add49869d93e4a
-
SHA512
79aec4e220d6257f5d80d88a0ca9902a7648662139213a537a4671609a7feeb6124f581df70e0f0e0c3ac44e0c48a3ac2948a021ef54b71d80639c5390dec269
-
SSDEEP
768:Yz1wV+XS+k9ylkrzLMQIjQExSO4+FDtL2lw7z3Fj9wbPk54ZJ4Ot:Yyx9mkr0G+hGYVj9wbcqZeOt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d64473c7932fbf935715be0c4d06332d_JaffaCakes118
Files
-
d64473c7932fbf935715be0c4d06332d_JaffaCakes118.exe windows:5 windows x86 arch:x86
20e41ce01f80755f4eea7fc12deb3017
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
ZwReadFile
ZwQueryInformationFile
strrchr
ZwCreateFile
ZwWriteFile
ZwQueryVolumeInformationFile
ZwQueryDirectoryFile
wcslen
ZwSetInformationFile
RtlAdjustPrivilege
RtlIpv4StringToAddressA
ZwOpenThreadTokenEx
_wcsicmp
strcmp
strcpy
sprintf
memcmp
strchr
ZwSetSecurityObject
LdrAccessResource
wcsrchr
swprintf
strlen
RtlDestroyQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlCreateQueryDebugBuffer
RtlEqualUnicodeString
ZwQuerySystemInformation
ZwSuspendThread
ZwQueryInformationThread
ZwOpenThread
_stricmp
RtlNtStatusToDosError
RtlIpv4AddressToStringA
ZwClose
ZwEnumerateKey
ZwOpenKey
ZwQueryKey
ZwResumeThread
ZwLoadDriver
ZwCreateSymbolicLinkObject
ZwUnmapViewOfSection
ZwFlushVirtualMemory
RtlImageNtHeader
ZwMapViewOfSection
ZwCreateSection
ZwFsControlFile
ZwOpenFile
ZwSetValueKey
ZwCreateKey
LdrFindResource_U
RtlInitUnicodeString
ZwAdjustPrivilegesToken
memset
RtlIpv4StringToAddressW
ZwQueryValueKey
ZwImpersonateThread
memcpy
kernel32
DeleteTimerQueueTimer
Sleep
GetVersion
ExitProcess
GetTickCount
CreateTimerQueueTimer
VirtualAlloc
GetSystemTimeAsFileTime
GetLastError
BindIoCompletionCallback
LocalFree
LocalAlloc
advapi32
MD5Update
MD5Final
MD5Init
ws2_32
WSACleanup
WSARecvFrom
WSASendTo
setsockopt
WSASend
WSARecv
WSAIoctl
bind
closesocket
WSAGetLastError
WSASocketW
WSAStartup
cabinet
ord20
ord22
ord23
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 432B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ