Static task
static1
Behavioral task
behavioral1
Sample
e0f38f07290179413ac6bfa751ad43d5_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e0f38f07290179413ac6bfa751ad43d5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e0f38f07290179413ac6bfa751ad43d5_JaffaCakes118
-
Size
15KB
-
MD5
e0f38f07290179413ac6bfa751ad43d5
-
SHA1
652f0f0eb40880c4a9b9a35d8333669b5ecc8b91
-
SHA256
48844776e09c28738a1c419cb6f29a1dbcf03846a4f0b1cee37933c497446d28
-
SHA512
cf32902f48e36fe9dc4e11e1011b2734e1578569d58f6c760aef6f930540f8744f93d7b38f926c5a9aaa95282d34fcfaa45ec1facc5c6c12cf23c67e66666403
-
SSDEEP
192:y4Pr/J3vubpX5hnF4B/sqrg2tM4JBowWCUqeeWM694U8dIP/9:y4PLlvOpzF6/r7ldhMf94U8i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e0f38f07290179413ac6bfa751ad43d5_JaffaCakes118
Files
-
e0f38f07290179413ac6bfa751ad43d5_JaffaCakes118.exe windows:4 windows x86 arch:x86
2c512db1d49c2e292b7c3e6c00b81074
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memset
memmove
sprintf
memcpy
strncpy
strlen
kernel32
GetModuleHandleA
HeapCreate
GetTempPathA
GetModuleFileNameA
Sleep
CreateMutexA
GetLastError
CloseHandle
ExitProcess
CopyFileA
FindResourceA
LoadResource
LockResource
SizeofResource
lstrlenA
HeapDestroy
GetTempFileNameA
CreateFileA
WriteFile
FindFirstFileA
FindClose
EnterCriticalSection
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSection
CreateThread
HeapAlloc
MultiByteToWideChar
HeapFree
WideCharToMultiByte
TlsAlloc
TlsGetValue
HeapReAlloc
TlsSetValue
WaitForMultipleObjects
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
DuplicateHandle
CreateSemaphoreA
ReleaseSemaphore
advapi32
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegDeleteValueA
wsock32
htons
inet_addr
socket
connect
send
recv
gethostbyname
closesocket
WSACleanup
WSAStartup
shell32
ShellExecuteA
Sections
.code Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ