Static task
static1
Behavioral task
behavioral1
Sample
da5482b8955a49afcca7404a3fd5c031_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
da5482b8955a49afcca7404a3fd5c031_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
da5482b8955a49afcca7404a3fd5c031_JaffaCakes118
-
Size
70KB
-
MD5
da5482b8955a49afcca7404a3fd5c031
-
SHA1
5563eb025a76e4a5e8b413451839f6faa67ef066
-
SHA256
669ba43c958a37babd9a3de76a71d9c8e43b258a2074a421e990b55e2cfd4f70
-
SHA512
af196ca82911627562960e7b46845721eb8f5de7d8adce22112bd8284548ace3f0efd66b26ee1307d3465bbde3fbe98cbd242356ce06aad31caf1dc6a7172247
-
SSDEEP
1536:UwxDN4KenLjkgRIn9TdgtkWT4gOUHi8gEwJWAtT/g:UwxDN4Kq3k6I96yH87wJWAtT/g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da5482b8955a49afcca7404a3fd5c031_JaffaCakes118
Files
-
da5482b8955a49afcca7404a3fd5c031_JaffaCakes118.exe windows:4 windows x86 arch:x86
01cd3ed53dac99a82ada6baf9bef3648
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
ntohl
htonl
bind
closesocket
getsockname
gethostbyname
WSAStartup
setsockopt
send
listen
accept
WSACleanup
inet_addr
shutdown
recv
inet_ntoa
socket
htons
ioctlsocket
connect
select
shell32
SHGetFolderPathA
advapi32
GetUserNameA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
wininet
InternetOpenUrlA
InternetReadFile
InternetOpenA
kernel32
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetEndOfFile
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LocalFree
RaiseException
TerminateThread
GetFileType
GetStdHandle
SetHandleCount
GlobalAlloc
GetTickCount
Sleep
CopyFileA
GetProcAddress
LoadLibraryA
MultiByteToWideChar
SetFileTime
CloseHandle
GetFileTime
CreateFileA
SetFileAttributesA
ExitThread
GetSystemDirectoryA
CreateDirectoryA
GetModuleFileNameA
GlobalFree
UnmapViewOfFile
lstrlenA
MapViewOfFile
CreateFileMappingA
SetFilePointer
WriteFile
GetFileSize
FindClose
FindNextFileA
lstrcatA
GetFullPathNameA
SetCurrentDirectoryA
FindFirstFileA
GetDriveTypeA
LeaveCriticalSection
EnterCriticalSection
CreateThread
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
lstrcmpiA
ExitProcess
CreateProcessA
WaitForSingleObject
CreateMutexA
SetErrorMode
GetTempPathA
GetLastError
GetVersionExA
HeapSize
ExpandEnvironmentStringsA
GetFileAttributesA
GetModuleHandleA
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetCurrentProcess
TerminateProcess
ReadFile
LCMapStringW
LCMapStringA
WideCharToMultiByte
GetVersion
GetCommandLineA
GetStartupInfoA
HeapFree
HeapAlloc
RtlUnwind
user32
CharLowerA
oleaut32
VariantClear
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE