Static task
static1
Behavioral task
behavioral1
Sample
09504da5239f8fb00f0b8ea86a67d046_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
09504da5239f8fb00f0b8ea86a67d046_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
09504da5239f8fb00f0b8ea86a67d046_JaffaCakes118
-
Size
149KB
-
MD5
09504da5239f8fb00f0b8ea86a67d046
-
SHA1
7c5c37a59bcec9533b119892f5debc4d5bbd7742
-
SHA256
d8b6b589a8a3ec26d2579017dea0f9a598f18d6b58e55ae54bd2bc98af391c39
-
SHA512
2eb6a9e98a424bf0f46cce68074a8d54ce1274bbd662d854e69801e66d983a5099d976bfef1b92c043e581cf834830f15a054a792286a371b5167ce7aa6fbcec
-
SSDEEP
3072:k9smH5s0gFM+X5Z7bYhzNX2LrYCkZAj0oApt/aHyJu0UL:WTeFMsZ7kmY5AjXet7DUL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09504da5239f8fb00f0b8ea86a67d046_JaffaCakes118
Files
-
09504da5239f8fb00f0b8ea86a67d046_JaffaCakes118.exe windows:1 windows x86 arch:x86
fbded7a146dc25211b421585e184b281
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetConsoleMode
GetLastError
WriteFile
SetEndOfFile
lstrcatA
LeaveCriticalSection
DeleteFileA
CreateFileW
FindNextFileA
CopyFileA
Sleep
GetTickCount
Module32FirstW
DeleteFileW
SetConsoleNumberOfCommandsW
CreateFileA
FindClose
InitializeCriticalSection
CreateProcessW
GetProcAddress
GetCurrentProcess
ReadFile
lstrcatW
GetTapeParameters
WriteProfileStringW
GetFileSizeEx
LoadLibraryA
InterlockedIncrement
FindFirstFileA
GetWindowsDirectoryA
lstrcpyW
GetConsoleCharType
lstrcpyA
DuplicateHandle
IsBadStringPtrW
GetProfileIntA
GetSystemDirectoryW
CreateSemaphoreA
FindFirstVolumeA
GetSystemDirectoryA
VirtualAlloc
VirtualFree
GetDiskFreeSpaceExW
GetModuleFileNameA
CreateMemoryResourceNotification
GetConsoleKeyboardLayoutNameA
GetModuleHandleA
GetVolumeNameForVolumeMountPointW
CloseHandle
OpenProcess
SetFirmwareEnvironmentVariableA
EnterCriticalSection
advapi32
RegQueryValueExA
RegSetValueExA
RegCreateKeyA
RegCloseKey
AdjustTokenPrivileges
LookupAccountNameW
CloseServiceHandle
EnumServicesStatusW
CryptDeriveKey
CredReadDomainCredentialsW
OpenSCManagerA
OpenProcessToken
EnumDependentServicesW
EnumServicesStatusA
RegOpenKeyA
LookupPrivilegeValueA
ntdll
wcsstr
isdigit
ZwLoadDriver
RtlAnsiStringToUnicodeString
NtQuerySystemInformation
NtQueryObject
sprintf
isspace
memset
strlen
vsprintf
strncmp
memcpy
tolower
strstr
RtlFreeUnicodeString
RtlInitAnsiString
_chkstk
ole32
CoCreateGuid
ws2_32
closesocket
__WSAFDIsSet
send
htons
htonl
WSAResetEvent
WSApSetPostRoutine
socket
WSAStartup
WSANSPIoctl
ioctlsocket
connect
gethostbyname
recv
connect
select
psapi
GetProcessImageFileNameA
EnumProcesses
user32
GetKeyboardLayoutNameA
CharLowerW
ExitWindowsEx
Sections
.data Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512B - Virtual size: 401B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ