Static task
static1
Behavioral task
behavioral1
Sample
ea17420b053aa505cb5a19ebe373c0f8_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea17420b053aa505cb5a19ebe373c0f8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ea17420b053aa505cb5a19ebe373c0f8_JaffaCakes118
-
Size
40KB
-
MD5
ea17420b053aa505cb5a19ebe373c0f8
-
SHA1
ccb38538cf6c2e408600e94c51a9b54d068691e6
-
SHA256
76a4f7e6b8b9fcb78e34a4ec999a297ed75f3fec52940d36dd26a8ab9b145b28
-
SHA512
8f67e4283297d2fe1d02405e45f172b120d3c7567bdb9c76e679c783d04253e58b8fa7fd350256bd83eb2c8275eb58e1469d519c534c7167326815660240eddb
-
SSDEEP
384:e4owb9u4vZx4ZFKmml811TyTSQC1tRODoRiYd4nyxoyTVkODiOL9BMsgJLgP:vo49vadyTQ1XOcQYqnKFTeCiOLrMsdP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea17420b053aa505cb5a19ebe373c0f8_JaffaCakes118
Files
-
ea17420b053aa505cb5a19ebe373c0f8_JaffaCakes118.exe windows:4 windows x86 arch:x86
4083232114adb5b705cd382585583f41
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetLastError
CreatePipe
GetStartupInfoA
LocalFree
FormatMessageA
Sleep
GetTempPathA
WriteFile
GetSystemDirectoryA
LoadLibraryExA
GetModuleFileNameA
FreeLibrary
DeleteFileA
GetProcAddress
LoadLibraryA
GetTempFileNameA
SetEnvironmentVariableA
FlushFileBuffers
FindFirstFileA
CreateProcessA
CreateFileA
ReadFile
LCMapStringW
LCMapStringA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
SetCurrentDirectoryA
GetEnvironmentStrings
WideCharToMultiByte
HeapFree
GetCurrentDirectoryA
GetFullPathNameA
GetDriveTypeA
HeapAlloc
GetModuleHandleA
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
user32
LoadStringA
advapi32
RegSetValueExA
RegCloseKey
RegOpenKeyExA
wininet
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
ws2_32
inet_addr
WSACleanup
socket
WSAStartup
htons
closesocket
recv
send
connect
shlwapi
PathFileExistsA
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ