Static task
static1
Behavioral task
behavioral1
Sample
01d0562e33833089a9f24fe30ca6d1b9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
01d0562e33833089a9f24fe30ca6d1b9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
01d0562e33833089a9f24fe30ca6d1b9_JaffaCakes118
-
Size
25KB
-
MD5
01d0562e33833089a9f24fe30ca6d1b9
-
SHA1
fa004abb507953f6006049576fb17212c42434d5
-
SHA256
ebe8350242624619d368f2cf5c505bdd86173b30e0c1578d3ebddffabb0f9d39
-
SHA512
39b7509964602ff18e216bc19cdc676288f7645e89e54c8efca222a114d8845a6c4bade9158ea0932142ecac6635443f39de5feabd3f51e53eb8d37472384b05
-
SSDEEP
384:F1DNcFeGfXA2C1FXjDbDngSlQ9LAuv3LZ/DPTTiSiSqE:F1DGHXA2CzTXMSmlAuvLJXi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 01d0562e33833089a9f24fe30ca6d1b9_JaffaCakes118
Files
-
01d0562e33833089a9f24fe30ca6d1b9_JaffaCakes118.exe windows:4 windows x86 arch:x86
1c422be7a9012dbafdc9306c4c4c5567
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSARecvFrom
rtutils
TraceDeregisterExA
TraceRegisterExA
TraceDumpExA
TracePrintfA
TracePrintfExA
TraceDeregisterA
TracePutsExA
ntdll
RtlAllocateHeap
NtAllocateVirtualMemory
wcsstr
RtlInitUnicodeString
RtlFreeHeap
RtlQueueWorkItem
NtClose
RtlNtStatusToDosError
RtlUnwind
NtWaitForSingleObject
NtImpersonateThread
NtCreateFile
NtDeviceIoControlFile
advapi32
OpenSCManagerA
ControlService
RegisterServiceCtrlHandlerA
OpenServiceA
StartServiceA
CloseServiceHandle
SetServiceStatus
QueryServiceStatus
kernel32
CreateEventA
GetTickCount
Sleep
EnterCriticalSection
InterlockedIncrement
WaitForSingleObject
LeaveCriticalSection
SetEvent
InterlockedDecrement
PostQueuedCompletionStatus
lstrlenW
DeviceIoControl
GlobalAlloc
lstrcpyW
ResetEvent
GetLastError
SleepEx
DeleteCriticalSection
SetLastError
Beep
InitializeCriticalSection
GetOverlappedResult
GlobalFree
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE