Static task
static1
Behavioral task
behavioral1
Sample
ea356e6f315e269c6a3071a8b0acd5c9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea356e6f315e269c6a3071a8b0acd5c9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ea356e6f315e269c6a3071a8b0acd5c9_JaffaCakes118
-
Size
27KB
-
MD5
ea356e6f315e269c6a3071a8b0acd5c9
-
SHA1
d61d2a02884bd89b4d21a3b824f09be0fc66b42b
-
SHA256
bf6b558f9b6d0ae5059479a1c60eb1b6e418450909810af477f74ba67e5b51a9
-
SHA512
2a010328cd50e0df26a94785477d6dc1d494dfa446027339b0a972d5c9abf1b837f9e58fbd1327b6cd20f418145e95067670c6f1134a80cb5820f87ab8b65552
-
SSDEEP
768:LS1SRYdlXrCG2n/AxhufO76vZev7Jq4r:2XrCG2/APuW76vZeR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea356e6f315e269c6a3071a8b0acd5c9_JaffaCakes118
Files
-
ea356e6f315e269c6a3071a8b0acd5c9_JaffaCakes118.exe windows:4 windows x86 arch:x86
442cbbdd7c336dcb19952a91a6fdaa7d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CreateStreamOnHGlobal
CoTaskMemFree
kernel32
GetWindowsDirectoryA
GetCurrentDirectoryA
GetDiskFreeSpaceA
CloseHandle
CreateFileA
CreateFileMappingA
CreateThread
CreateToolhelp32Snapshot
lstrlenW
lstrlenA
lstrcpynA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
GetCommandLineA
lstrcpyA
lstrcmpiA
lstrcatA
WriteFile
WinExec
WideCharToMultiByte
UnmapViewOfFile
TerminateProcess
Sleep
Process32Next
Process32First
OpenProcess
MultiByteToWideChar
MapViewOfFile
LocalFree
LocalAlloc
LoadLibraryA
GlobalMemoryStatus
GlobalFree
GlobalAlloc
GetDriveTypeA
GetVolumeInformationA
GetVersionExA
GetTempPathA
GetSystemDirectoryA
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetModuleFileNameA
GetLogicalDrives
GetLocaleInfoA
GetLocalTime
GetFileSize
GetComputerNameA
user32
ReleaseDC
GetDC
wsprintfA
oleaut32
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
advapi32
ChangeServiceConfigA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumValueA
RegEnumKeyExA
ControlService
OpenServiceA
OpenSCManagerA
GetUserNameA
CloseServiceHandle
shlwapi
StrCmpNA
StrRChrA
StrChrA
StrStrIA
wsock32
socket
send
recv
gethostname
connect
closesocket
WSAStartup
ws2_32
WSAIoctl
rasapi32
RasGetEntryDialParamsA
RasEnumEntriesA
RasGetEntryPropertiesA
gdi32
GetDeviceCaps
Sections
Size: 20KB - Virtual size: 19KB
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 2KB
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 185KB
IMAGE_SCN_MEM_WRITE
Size: 257B - Virtual size: 257B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE