Static task
static1
Behavioral task
behavioral1
Sample
f629ca9b9c1050b35657d202cd4ab722_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f629ca9b9c1050b35657d202cd4ab722_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
f629ca9b9c1050b35657d202cd4ab722_JaffaCakes118
-
Size
312KB
-
MD5
f629ca9b9c1050b35657d202cd4ab722
-
SHA1
ea9fe5bb08f4f0a1d375b29d7d6627c26dbdb646
-
SHA256
a856a00dfdc35b17b8678f222e03a34f67e899d07ed3fe91369c18183bc1dc27
-
SHA512
ac414191a094955c70afde46c844a26f25e75bf4cfd0bba66666e5443625b3cf198d19e251a58986e2d595886b3e8a2e0968fcdad9771c9c6f93abadb1e03e49
-
SSDEEP
3072:0OZ051j0jyQI66EAd7BK1IChrDNlxS3Io+45+0IeO3bhb07Yv:0OOnj0jEIkBWIChrjxS3IoDUvT3bg2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f629ca9b9c1050b35657d202cd4ab722_JaffaCakes118
Files
-
f629ca9b9c1050b35657d202cd4ab722_JaffaCakes118.exe windows:4 windows x86 arch:x86
85a7e7bdb1b2f3aad3b7f861b4813a6e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
GetTimeFormatA
GetLocalTime
CreateThread
ExpandEnvironmentStringsA
CloseHandle
WriteFile
CreateFileA
DeleteFileA
GetTempPathA
GetVersionExA
GlobalMemoryStatus
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetStringTypeW
CreateMutexA
GetLastError
Sleep
GetSystemDirectoryA
CopyFileA
TerminateThread
CreateProcessA
GetStringTypeA
FlushFileBuffers
SetStdHandle
SetFilePointer
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
SetEndOfFile
UnhandledExceptionFilter
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
ReadFile
GetVersion
GetCommandLineA
GetStartupInfoA
HeapAlloc
HeapFree
GetCurrentProcess
TerminateProcess
ExitProcess
user32
FindWindowA
SendMessageA
mpr
WNetAddConnection2A
WNetCancelConnection2A
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
shell32
ShellExecuteA
ws2_32
gethostbyaddr
bind
listen
accept
recv
socket
inet_ntoa
send
setsockopt
htons
htonl
sendto
WSAGetLastError
inet_addr
gethostbyname
WSAStartup
WSACleanup
closesocket
getsockname
select
ioctlsocket
ntohl
WSAAsyncSelect
__WSAFDIsSet
connect
WSASocketA
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
Sections
����t Size: 308KB - Virtual size: 308KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE