Static task
static1
Behavioral task
behavioral1
Sample
e129fc74ae33541a58d26b015ab8b4e3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e129fc74ae33541a58d26b015ab8b4e3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e129fc74ae33541a58d26b015ab8b4e3_JaffaCakes118
-
Size
44KB
-
MD5
e129fc74ae33541a58d26b015ab8b4e3
-
SHA1
c46007257f1e4cde8b7c8e8b55b3a5f66bc78736
-
SHA256
9445cc20fb03251752f2b3becc35a00769f557dc55c634f049487b6fb221003b
-
SHA512
cc31337e99f5a81a0616ae187fe1514d1ff28648492d1fb5810a6a220e4e4cfae42078f93142f7d3891da509103e11fcf2f3a377c634524e522007980a9bf93a
-
SSDEEP
768:TERAUXdTYCcv3YgzEvzDmDLJLET8i6i1ij03aEqYcaU+C:YDNmvvmTei1ij03aEOL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e129fc74ae33541a58d26b015ab8b4e3_JaffaCakes118
Files
-
e129fc74ae33541a58d26b015ab8b4e3_JaffaCakes118.exe windows:4 windows x86 arch:x86
14f3c2bd2936ba6098eca82622e68786
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateFileA
CopyFileA
LeaveCriticalSection
EnterCriticalSection
GetLastError
DeleteFileA
GetSystemDirectoryA
Sleep
PeekNamedPipe
SetLastError
SetFilePointer
SizeofResource
LockResource
LoadResource
FindResourceA
WriteFile
CreateThread
TerminateThread
WaitForMultipleObjects
DisconnectNamedPipe
GetCurrentProcess
TerminateProcess
DeleteCriticalSection
ReadFile
InitializeCriticalSection
user32
wsprintfA
advapi32
DeleteService
ChangeServiceConfig2A
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
ControlService
CreateServiceA
mpr
WNetAddConnection2A
WNetCancelConnection2A
netapi32
NetShareGetInfo
NetApiBufferFree
msvcrt
_stricmp
__dllonexit
_controlfp
_except_handler3
??3@YAXPAX@Z
printf
sprintf
strchr
strncpy
strncmp
gets
wcstombs
mbstowcs
_snprintf
_strnicmp
_onexit
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ