Static task
static1
Behavioral task
behavioral1
Sample
d9489eef358d1e0ba6658a6dd7d0567a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d9489eef358d1e0ba6658a6dd7d0567a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d9489eef358d1e0ba6658a6dd7d0567a_JaffaCakes118
-
Size
314KB
-
MD5
d9489eef358d1e0ba6658a6dd7d0567a
-
SHA1
9bcff8acdb9855af43fee177fa3ea6187596b95e
-
SHA256
37523a3faedfda08f4fcbe718b8aed77d5c041c980a91d96bd68961afa8f8123
-
SHA512
ea09f048ef41fc2b2b68f5c42f14720965a5729315035dbf9a6d6e3d00efd22fb6e4146a6265199638fac8143ec80efda7b2945525099259d0021535c6c8637f
-
SSDEEP
6144:iV4oh9t9yMLji1F88zvIZDN1WmWOzgJ88aciNTVncCGXZ6KPJIs5k6YkB:iiyIgji1ZzvI1N8mZEJSBncCwpPJI+k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d9489eef358d1e0ba6658a6dd7d0567a_JaffaCakes118
Files
-
d9489eef358d1e0ba6658a6dd7d0567a_JaffaCakes118.exe windows:4 windows x86 arch:x86
666f0cb07e58593bffca742950541796
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
RpcBindingFree
RpcBindingFromStringBindingA
RpcMgmtEpEltInqBegin
RpcMgmtEpEltInqNextA
RpcStringFreeA
RpcBindingToStringBindingA
UuidToStringA
ws2_32
gethostbyname
shutdown
setsockopt
WSAStartup
sendto
accept
htons
recv
send
ntohs
inet_ntoa
socket
ioctlsocket
connect
closesocket
__WSAFDIsSet
select
listen
bind
WSACleanup
WSASocketA
inet_addr
wininet
InternetOpenA
InternetOpenUrlA
InternetReadFile
kernel32
GlobalLock
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
RaiseException
GetOEMCP
GetACP
GetCPInfo
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersion
GetCommandLineA
ExitThread
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetSystemDirectoryA
GetLocalTime
ExitProcess
WriteFile
CloseHandle
CreateFileA
GetModuleFileNameA
GetTimeFormatA
GetDateFormatA
GetLastError
CreateThread
GetFileSize
GetFileAttributesA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileA
FindFirstFileA
ReadFile
SetFilePointer
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FreeLibrary
GetEnvironmentVariableW
GetProcAddress
LoadLibraryA
HeapFree
HeapAlloc
GetProcessHeap
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
OpenProcess
GetCurrentProcess
GetModuleHandleA
FormatMessageA
GlobalUnlock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
CreateProcessA
ExpandEnvironmentStringsA
SetFileAttributesA
GetTempPathA
lstrlenA
GetExitCodeProcess
PeekNamedPipe
DuplicateHandle
CreatePipe
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
VirtualFreeEx
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
DeleteFileA
GetVersionExA
GlobalMemoryStatus
WideCharToMultiByte
MultiByteToWideChar
GetComputerNameA
GetCurrentProcessId
CopyFileA
WaitForSingleObject
CreateMutexA
MoveFileA
TerminateProcess
GetLocaleInfoA
GetLogicalDrives
WaitForMultipleObjects
TerminateThread
GenerateConsoleCtrlEvent
GetTimeZoneInformation
GetSystemTime
RtlUnwind
HeapReAlloc
GetStartupInfoA
Sections
.text Size: 190KB - Virtual size: 189KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 115KB - Virtual size: 1001KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE