Static task
static1
Behavioral task
behavioral1
Sample
01b0bbb76bdc841ef982f8ff0bba6060_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
01b0bbb76bdc841ef982f8ff0bba6060_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
01b0bbb76bdc841ef982f8ff0bba6060_JaffaCakes118
-
Size
84KB
-
MD5
01b0bbb76bdc841ef982f8ff0bba6060
-
SHA1
7e0bbe57ce411b643af4a1e3a65639ab3a724a49
-
SHA256
d88706d12f30831766c2b7496fe7506e204c59107e48923bcfcb4b804ad9a846
-
SHA512
6106d83b05fe2da4ddc446d110f11bb68926de82839f636fb14bf0c27074c4759cff546922777a521e30813157a16e6351f71ff7698fb4ab4152a9b65cc5944f
-
SSDEEP
1536:uYLBnFmNR236Be2KKEC4It+LNsB+/fazYLMgkkd+3LH:uYLBnFK230SD/fazYLMX3L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 01b0bbb76bdc841ef982f8ff0bba6060_JaffaCakes118
Files
-
01b0bbb76bdc841ef982f8ff0bba6060_JaffaCakes118.exe windows:4 windows x86 arch:x86
abe4fd397c5cc05368015344335bae99
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetModuleHandleA
ExitThread
ExitProcess
Sleep
GetTickCount
CreateMutexA
GetLastError
CreateThread
CloseHandle
FlushFileBuffers
HeapSize
LCMapStringW
LCMapStringA
GetSystemInfo
VirtualProtect
SetStdHandle
HeapReAlloc
VirtualAlloc
InitializeCriticalSection
GetOEMCP
GetACP
GetStartupInfoA
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetCPInfo
GetLocaleInfoA
advapi32
RegSetValueExA
RegCloseKey
RegCreateKeyExA
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
ws2_32
bind
listen
accept
recv
send
gethostbyname
setsockopt
htons
connect
select
__WSAFDIsSet
closesocket
WSACleanup
WSAStartup
socket
Sections
Size: 80KB - Virtual size: 80KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE