Static task
static1
Behavioral task
behavioral1
Sample
059aa59cb1954a631599a913fd2b8488_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
059aa59cb1954a631599a913fd2b8488_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
059aa59cb1954a631599a913fd2b8488_JaffaCakes118
-
Size
28KB
-
MD5
059aa59cb1954a631599a913fd2b8488
-
SHA1
a8dbb9173be6668cceb95d487a7d07259c795927
-
SHA256
f12976f976ff2e442b076ea376f830b5075c314a06f3039f0531038f18facef8
-
SHA512
64b080d7ce938b8c2f8ce69bd1ec2d9097ad3b4c0d69f8ff4f2d002b8bca921f68227fa5310ef7aff519092c185192c3c870d3c12c2dbb1d4e584fc64f48c0f4
-
SSDEEP
384:lYQEj45NqWW54+VOd4u4yisr++OBIOCjPwVIQUEfL8xt:lzEj4n9WbVOd4uwsrkCjPQIgfor
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 059aa59cb1954a631599a913fd2b8488_JaffaCakes118
Files
-
059aa59cb1954a631599a913fd2b8488_JaffaCakes118.exe windows:4 windows x86 arch:x86
1f0802920d5a4fd3571bbd626034c2d2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord540
ord2846
ord2818
ord537
ord2764
ord6648
ord4129
ord800
ord2915
ord825
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
printf
rand
srand
time
_XcptFilter
_exit
_except_handler3
strncmp
strstr
exit
sprintf
strchr
atoi
__CxxFrameHandler
kernel32
GetProcessHeap
GetCurrentProcessId
CreateThread
lstrlenA
CreateProcessA
GetSystemDirectoryA
GlobalMemoryStatus
GetVersionExA
WaitForSingleObject
ResumeThread
GetCurrentThread
GetStartupInfoA
GetModuleHandleA
CopyFileA
GetLastError
GetModuleFileNameA
GetShortPathNameA
GetEnvironmentVariableA
lstrcpyA
lstrcatA
GetCurrentProcess
SetPriorityClass
ExitThread
Sleep
GetTickCount
HeapAlloc
SetThreadPriority
user32
wsprintfA
comdlg32
GetFileTitleA
advapi32
CreateServiceA
OpenServiceA
OpenSCManagerA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegOpenKeyExA
RegCloseKey
CloseServiceHandle
RegSetValueExA
RegOpenKeyA
DeleteService
StartServiceA
ws2_32
select
send
sendto
setsockopt
WSASocketA
inet_addr
htons
WSAStartup
gethostbyname
recv
__WSAFDIsSet
connect
socket
closesocket
inet_ntoa
gethostname
htonl
WSAGetLastError
urlmon
URLDownloadToFileA
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 243KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE