Static task
static1
Behavioral task
behavioral1
Sample
eb90e9178cfb4a12b8419e2a6f7f0352_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
eb90e9178cfb4a12b8419e2a6f7f0352_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eb90e9178cfb4a12b8419e2a6f7f0352_JaffaCakes118
-
Size
40KB
-
MD5
eb90e9178cfb4a12b8419e2a6f7f0352
-
SHA1
faf449a03e3fbc4db72fe111f53c3c70369f5c09
-
SHA256
f35bbf5a2209e748241209d40e34d9cb55498135ea44ff85558f80b2787d6b7d
-
SHA512
326bdeca96235471ae5e28a1a1d5f0b7f2f7bd5dbf68cd00ccb238d30df59a8f312e0b4f9b25284b63a3275582465b424cbd049790d66ac8d94342b697bb2c61
-
SSDEEP
384:hxcPcwznqOiczb8ocNPB6m+fReA/yZoFYRRkfOrFK1al:j4cw+Oi6ENPufReA/yqf8K8l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb90e9178cfb4a12b8419e2a6f7f0352_JaffaCakes118
Files
-
eb90e9178cfb4a12b8419e2a6f7f0352_JaffaCakes118.exe windows:4 windows x86 arch:x86
b3f8d9736b4c4c8bb28def49e7dd39df
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
HeapFree
ReadFile
HeapAlloc
GetProcessHeap
GetFileInformationByHandle
CreateFileA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
LocalFree
lstrlenA
GetVersionExA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateToolhelp32Snapshot
Module32Next
lstrcmpA
Module32First
GetCurrentProcessId
VirtualQueryEx
GetVersion
IsBadReadPtr
CreateThread
WriteFile
GetFileSize
LoadLibraryA
GetModuleFileNameA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Process32First
Process32Next
OpenProcess
CreateRemoteThread
GetCurrentProcess
ReadProcessMemory
VirtualFreeEx
VirtualAllocEx
VirtualProtectEx
WriteProcessMemory
FreeLibrary
lstrcatA
TerminateProcess
GetSystemTimeAsFileTime
RtlUnwind
user32
wsprintfA
MessageBoxA
advapi32
GetSecurityInfo
GetUserNameA
SetEntriesInAclA
SetSecurityInfo
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
ws2_32
select
recv
WSACleanup
htons
inet_addr
ioctlsocket
accept
listen
bind
__WSAFDIsSet
closesocket
send
socket
WSAStartup
connect
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 4KB - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ