Static task
static1
Behavioral task
behavioral1
Sample
f9fd0b161a25e18d9f5f9d4c95aa4c58_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f9fd0b161a25e18d9f5f9d4c95aa4c58_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f9fd0b161a25e18d9f5f9d4c95aa4c58_JaffaCakes118
-
Size
230KB
-
MD5
f9fd0b161a25e18d9f5f9d4c95aa4c58
-
SHA1
37e89df28aab8bce7706ece4c368a6915f4ca51f
-
SHA256
fd7d9201baa7cbaaf094da2f1b1defe90070a3429c01709b38e92f06067e901d
-
SHA512
4df23f161a0766938431c4d326be928d27eacd5c19dcfabc6d483b74d51b8fc438e046d6e05bc4407fe00b243d3299a58878a3720af8d3a502f69283cbc49d6d
-
SSDEEP
3072:6REdb5fo4AjylkXglwM3Uiuq0IiU0dM9n2PGLd4tjXHjVzXHKuI5BIJ0K:6REhRojjyOglwMrydVPBXHjBtITK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9fd0b161a25e18d9f5f9d4c95aa4c58_JaffaCakes118
Files
-
f9fd0b161a25e18d9f5f9d4c95aa4c58_JaffaCakes118.exe windows:5 windows x86 arch:x86
152b1abdc905f27d02a4a70b9770f0d4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHGetValueA
ws2_32
socket
htons
connect
WSACleanup
WSAStartup
gethostbyname
closesocket
winmm
timeGetTime
kernel32
GetCurrentDirectoryA
WaitForSingleObject
FreeLibrary
GetProcAddress
CloseHandle
InterlockedIncrement
InterlockedDecrement
GetExitCodeProcess
CreateProcessA
GetModuleHandleA
SetCurrentDirectoryA
GetFullPathNameA
CreateFileA
GetModuleFileNameA
GetDiskFreeSpaceExA
GetSystemInfo
GetVolumeInformationA
LoadLibraryA
Sleep
TerminateProcess
GetLogicalDrives
GetSystemTime
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
GetCurrentDirectoryW
FindClose
CreateDirectoryA
FindNextFileA
FindFirstFileA
SetFilePointer
GlobalFree
GlobalAlloc
GetTickCount
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetACP
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
FlushFileBuffers
GetConsoleMode
GetConsoleCP
WriteFile
ExitProcess
WriteConsoleA
InitializeCriticalSectionAndSpinCount
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
SetEndOfFile
GetProcessHeap
DeleteFileA
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapSize
GetFileType
GetStdHandle
SetHandleCount
ReadFile
GetModuleHandleW
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoA
GetCommandLineA
HeapAlloc
HeapFree
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetLastError
GetCurrentThreadId
user32
SetForegroundWindow
SetActiveWindow
ShowWindow
FindWindowA
SetWindowLongA
IsWindowUnicode
GetWindowLongA
GetCursorPos
PostMessageA
AdjustWindowRectEx
CreateWindowExA
LoadCursorA
RegisterClassExA
GetSystemMetrics
DefWindowProcA
SetTimer
KillTimer
IsWindow
GetAsyncKeyState
GetMessageA
TranslateMessage
DispatchMessageA
UnregisterClassA
DestroyWindow
DestroyIcon
GetClientRect
EnumChildWindows
GetClassNameA
MessageBoxA
gdi32
GetStockObject
advapi32
RegDeleteKeyA
RegCreateKeyExA
RegEnumKeyA
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
RegEnumValueA
RegCloseKey
RegEnumKeyExA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ExtractIconA
SHGetSpecialFolderPathW
ole32
CoTaskMemFree
CoTaskMemAlloc
OleInitialize
CoCreateInstance
oleaut32
VariantClear
VariantInit
SysAllocString
Sections
.text Size: 220KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE