Static task
static1
Behavioral task
behavioral1
Sample
0aeb72e2a391a88922f0357016a61ad6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0aeb72e2a391a88922f0357016a61ad6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0aeb72e2a391a88922f0357016a61ad6_JaffaCakes118
-
Size
156KB
-
MD5
0aeb72e2a391a88922f0357016a61ad6
-
SHA1
c13a7d5e77131ee4cb515cf27c740f7c8ce8ae36
-
SHA256
de31c4baa440f4a247ea59207a4aa22e3a1c8c2a5b2dd276791a6893b1073798
-
SHA512
75cce909389876efcb1dd774a3e58d7b9a91d6591abf2e5218e3f597972981fe965996fbba15230256cdf8cd4aa4ee68612e80ead04d63e22ccc4edd10925b5b
-
SSDEEP
1536:EIZzo3NmMk5r8NKDfnHvLT+MdFNjjgozOyyWOgo2u:kJk5rLrvX+M/NAoaxWOgol
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0aeb72e2a391a88922f0357016a61ad6_JaffaCakes118
Files
-
0aeb72e2a391a88922f0357016a61ad6_JaffaCakes118.exe windows:4 windows x86 arch:x86
27edb9813bbf42aea9a0b5ffdfb3a5de
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessA
GetStartupInfoA
CreatePipe
TerminateProcess
GetExitCodeProcess
GetProcAddress
LoadLibraryA
SetStdHandle
GetOEMCP
CloseHandle
PeekNamedPipe
ReadFile
WriteFile
GetCurrentDirectoryA
GetWindowsDirectoryA
CopyFileA
OpenProcess
Sleep
GetACP
GetCPInfo
SetFilePointer
GetStringTypeW
GetStringTypeA
SetConsoleCtrlHandler
RtlUnwind
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
VirtualAlloc
GetCurrentProcess
FlushFileBuffers
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetModuleHandleA
GetCommandLineA
GetVersion
ExitProcess
DebugBreak
GetStdHandle
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapAlloc
HeapReAlloc
HeapFree
GetLastError
HeapDestroy
HeapCreate
VirtualFree
user32
MessageBoxA
advapi32
EnumServicesStatusA
OpenServiceA
ControlService
CloseServiceHandle
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenSCManagerA
wsock32
connect
gethostname
gethostbyname
inet_addr
WSAStartup
socket
gethostbyaddr
bind
WSACleanup
listen
accept
send
recv
closesocket
htons
ioctlsocket
Sections
.text Size: 128KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ