Static task
static1
Behavioral task
behavioral1
Sample
efbf81c00d7395642515d368366180dd_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
efbf81c00d7395642515d368366180dd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
efbf81c00d7395642515d368366180dd_JaffaCakes118
-
Size
92KB
-
MD5
efbf81c00d7395642515d368366180dd
-
SHA1
9ed3d6aa3150633951dc6560ba8241b85c85209b
-
SHA256
8b5b0af9706b09390b5dc1d611aae13435009a613079cef403b20651fc195c37
-
SHA512
a97611cdb8c1d44ce9f5755d9c06ba39a294a6cb297aaa25b2bbc7415894ca9081636f31ff30ea382e4dfd83d2ee5e56e357fe33a181b206c95a5c2c6efd77b7
-
SSDEEP
1536:9BTFfAor4bCgcD8v2Y7ZhQdo4U2iaEdYfVAodwUB:Zf5sbco9FhQXU2f9fVAod
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource efbf81c00d7395642515d368366180dd_JaffaCakes118
Files
-
efbf81c00d7395642515d368366180dd_JaffaCakes118.exe windows:4 windows x86 arch:x86
af8e5d85c678af6736e359a4fc4b32bb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryA
GetModuleFileNameA
Sleep
TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
DeleteFileA
GetComputerNameA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
SetFileAttributesA
SetStdHandle
SetConsoleCtrlHandler
RtlUnwind
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapAlloc
ReadFile
GetFileType
SetHandleCount
CreateFileA
FindFirstFileA
FlushFileBuffers
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
SetFilePointer
InterlockedIncrement
OutputDebugStringA
InterlockedDecrement
WriteFile
SetEndOfFile
GetStdHandle
DebugBreak
ExitProcess
GetLastError
MoveFileA
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
user32
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
LoadStringA
TranslateMessage
LoadCursorA
LoadIconA
SetTimer
UpdateWindow
ShowWindow
RegisterClassExA
OpenClipboard
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
wsprintfA
DispatchMessageA
GetClipboardData
CloseClipboard
DestroyWindow
PostQuitMessage
DefWindowProcA
CreateWindowExA
advapi32
GetUserNameA
shell32
ShellExecuteA
wininet
InternetGetConnectedState
wsock32
send
recv
connect
htons
closesocket
gethostbyname
ioctlsocket
WSACleanup
WSAStartup
socket
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ