Static task
static1
Behavioral task
behavioral1
Sample
09ce156815d91dd4b993bf037b76ca5e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
09ce156815d91dd4b993bf037b76ca5e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
09ce156815d91dd4b993bf037b76ca5e_JaffaCakes118
-
Size
44KB
-
MD5
09ce156815d91dd4b993bf037b76ca5e
-
SHA1
25aec27672f2332e9e2759521cc97b32bec0d51f
-
SHA256
a3971fbe4a834ccc43bcc4c6a8b32db779efd6dbd7e7380ee05882b513d8bec6
-
SHA512
6c4cf690d2f3043bc6ae95a8fe5a6f7f9642c526efeee2e9ca44dc1f1db781959f12494108820f2088506850811941555c2b02ca51f26d975565c47d5e99a719
-
SSDEEP
768:0a9et0vfDdk0Z2h6Xpki7lX1ibce+thl0w8NNVeprgohN0nunZ:0agGfDd72sXmGX1ibp+rqwCeprVZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09ce156815d91dd4b993bf037b76ca5e_JaffaCakes118
Files
-
09ce156815d91dd4b993bf037b76ca5e_JaffaCakes118.exe windows:4 windows x86 arch:x86
7495906c22ec706c0ea3b06e25bbeac2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord2784
ord2764
ord2763
ord940
ord1105
ord3337
ord3811
ord5856
ord551
ord5861
ord4202
ord5207
ord3646
ord3584
ord397
ord543
ord699
ord803
ord3438
ord913
ord398
ord912
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord922
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord2621
ord1247
ord654
ord5858
ord341
ord550
ord6877
ord2725
ord1576
ord939
ord6143
ord6869
ord354
ord350
ord5186
ord665
ord6385
ord1979
ord3616
ord3127
ord5651
ord268
ord389
ord6059
ord5356
ord941
ord1988
ord690
ord1567
ord3790
ord536
ord5710
ord5683
ord4129
ord6282
ord6283
ord4278
ord858
ord4277
ord2107
ord823
ord2841
ord6394
ord6383
ord5440
ord5450
ord3663
ord541
ord6883
ord801
ord537
ord924
ord2915
ord5572
ord535
ord860
ord2818
ord825
ord540
ord3346
ord800
ord1168
msvcrt
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
memcpy
tolower
malloc
free
__CxxFrameHandler
_setmbcp
qsort
strstr
strtol
_mbsicmp
strcpy
_mbscmp
strncpy
memset
atoi
_controlfp
kernel32
GetTickCount
lstrcpyA
CreateDirectoryA
GetModuleFileNameA
GetCurrentThreadId
GetCurrentProcessId
lstrcatA
OutputDebugStringA
DeleteFileA
lstrlenA
MultiByteToWideChar
GetVersionExA
GetProcAddress
GetModuleHandleA
MoveFileA
CreateEventA
SetEvent
GetLastError
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
Sleep
OpenEventA
GetStartupInfoA
ExpandEnvironmentStringsA
GetFileAttributesExA
CloseHandle
WaitForSingleObject
ResumeThread
WideCharToMultiByte
user32
wvsprintfA
wsprintfA
advapi32
RegSetValueA
RegCreateKeyA
RegSetValueExA
RegQueryValueA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
SHGetDesktopFolder
SHGetSpecialFolderPathA
oleaut32
SysAllocStringLen
SysFreeString
wsock32
inet_addr
gethostbyname
wininet
InternetCloseHandle
iphlpapi
GetAdaptersInfo
winmm
timeSetEvent
timeKillEvent
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ