Static task
static1
Behavioral task
behavioral1
Sample
06522e44321ae956bb17814257821f91_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
06522e44321ae956bb17814257821f91_JaffaCakes118
-
Size
250KB
-
MD5
06522e44321ae956bb17814257821f91
-
SHA1
d47a4c9c5d6a60dc653d605b7e9c2ddb16f16a1e
-
SHA256
ea4bae2cc59c73bdb47a366396cee81169bc3316b11ebc3b55411b56da328961
-
SHA512
6961e675b66c7d845ca81acd973656375e12aae73d83d124a6feb93408bf41ad1e4f00f2e4569868a9f15bcd69dc9c3382647c03f24c6d0d3f6b818a5c5de9e2
-
SSDEEP
6144:5Hb1tZxRirv7dq5DaTTw85LTvzcuJhoxr2o:5HbBxArv7UETVJzNGT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 06522e44321ae956bb17814257821f91_JaffaCakes118
Files
-
06522e44321ae956bb17814257821f91_JaffaCakes118.exe windows:5 windows x86 arch:x86
4d63ef07fbaab7d32b57a935dbcb4204
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryPerformanceCounter
QueryPerformanceFrequency
ExitThread
GetTickCount
Sleep
GetSystemDirectoryA
GetLocalTime
GetLastError
CreateThread
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
lstrcpynA
lstrcmpA
lstrcpyA
lstrlenA
GetProcAddress
LoadLibraryA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileA
FindFirstFileA
CloseHandle
ReadFile
SetFilePointer
GetFileSize
CreateFileA
GetTimeFormatA
GetDateFormatA
GetFileAttributesA
WriteFile
HeapFree
HeapAlloc
GetProcessHeap
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
OpenProcess
FreeLibrary
GetEnvironmentVariableW
GetModuleHandleA
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
CreateProcessA
ExpandEnvironmentStringsA
SetFileAttributesA
GetTempPathA
GetExitCodeProcess
PeekNamedPipe
DuplicateHandle
GetCurrentProcess
CreatePipe
GetVersionExA
GlobalMemoryStatus
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
GetComputerNameA
DeleteFileA
MoveFileA
GetCurrentProcessId
CopyFileA
WaitForSingleObject
CreateMutexA
TerminateProcess
lstrcmpiA
GetLocaleInfoA
GetLogicalDrives
TerminateThread
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetStringTypeW
GetStringTypeA
HeapSize
FlushFileBuffers
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RtlUnwind
GetSystemTimeAsFileTime
HeapReAlloc
GetModuleHandleW
GetCommandLineA
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapCreate
VirtualFree
VirtualAlloc
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
user32
wsprintfA
ws2_32
listen
select
__WSAFDIsSet
accept
recv
send
WSAStartup
bind
htons
WSACleanup
ntohs
inet_ntoa
socket
ioctlsocket
connect
closesocket
setsockopt
inet_addr
Sections
.text Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 906KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ