Static task
static1
Behavioral task
behavioral1
Sample
f6b09857a7915e67a2e6d3c19230ac33_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f6b09857a7915e67a2e6d3c19230ac33_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f6b09857a7915e67a2e6d3c19230ac33_JaffaCakes118
-
Size
60KB
-
MD5
f6b09857a7915e67a2e6d3c19230ac33
-
SHA1
f76a84666e0f9b3417826b0dbb70b1bfbf69dbf4
-
SHA256
70cf2c3a4216152bd0fe034d33f2e042a90d31c23be36f8d6c272be7ae0671dc
-
SHA512
4dd38e7791724f8b1e3ff98dfd599f9f85083b41baa0ff673b388fc44ddff6881154f7dabf7d43cbb62d6ae7709f7ba18739bd4d25631a1caab20596f6a8cb47
-
SSDEEP
768:9gTuCL5acYxjEwpofcxv+N1t9L3vuTwrb8KYpqTAbSFAYdxoG7u:9gRLlYhpof6+bma8KYEoOoG7u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6b09857a7915e67a2e6d3c19230ac33_JaffaCakes118
Files
-
f6b09857a7915e67a2e6d3c19230ac33_JaffaCakes118.exe windows:4 windows x86 arch:x86
f7ff1d73ab313fbd9a1d382461da242c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
CreateThread
Sleep
GetConsoleWindow
ExitProcess
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetStdHandle
ReadFile
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
MultiByteToWideChar
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
RtlUnwind
RaiseException
HeapFree
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
WriteFile
GetLastError
SetFilePointer
FlushFileBuffers
CloseHandle
SetUnhandledExceptionFilter
GetCPInfo
user32
ShowWindow
ws2_32
gethostbyname
WSACleanup
socket
WSAStartup
connect
recv
closesocket
send
htons
Sections
.text Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE