Static task
static1
Behavioral task
behavioral1
Sample
dbe262168e5586933bbf353fe2f642b5_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dbe262168e5586933bbf353fe2f642b5_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
dbe262168e5586933bbf353fe2f642b5_JaffaCakes118
-
Size
42KB
-
MD5
dbe262168e5586933bbf353fe2f642b5
-
SHA1
026fe9a6982ec9736c6d0c38dd6e2743518363f0
-
SHA256
0628099593abd2de3e67ad20fb6a467165e1162b2cc7f1f30d01979bc8420812
-
SHA512
cbf97f15015dceb2cf37937673ff228b87d93f082cf07c6b09f104c8b30fcc805d377241f686a89d545390b6eff4b393d24a278a8d96f0b76c164cdb95eae0b1
-
SSDEEP
768:1f+HpEWi+0cdvlqGX7NXMZGLRmDjYAI+AGPbAhbanF0HSPLzSAcWOInitoCr+PGV:1f+HCv+0cdMGrN8G4DjMQPbvnvPLzUWs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dbe262168e5586933bbf353fe2f642b5_JaffaCakes118
Files
-
dbe262168e5586933bbf353fe2f642b5_JaffaCakes118.exe windows:4 windows x86 arch:x86
02c56221b244bf9ecdc79f13456b3726
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
GetUserNameA
kernel32
AddAtomA
CloseHandle
CreateMutexA
CreateSemaphoreA
CreateThread
ExitProcess
ExitThread
FindAtomA
FreeLibrary
GetAtomNameA
GetCommandLineA
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetTickCount
HeapAlloc
HeapFree
InterlockedDecrement
InterlockedIncrement
IsBadReadPtr
LoadLibraryA
OpenProcess
ReleaseMutex
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
VirtualProtect
WaitForSingleObject
msvcrt
_itoa
_stricmp
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
atof
fclose
fflush
fopen
fprintf
free
fwrite
malloc
memcpy
memset
printf
rand
realloc
signal
sprintf
srand
strchr
strcmp
strcpy
strrchr
strstr
strtok
tolower
ws2_32
WSAGetLastError
WSAStartup
closesocket
connect
gethostbyaddr
gethostbyname
htons
inet_addr
recv
send
shutdown
socket
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 19KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE