Static task
static1
Behavioral task
behavioral1
Sample
0bc28f41b65b8e225e35493ee88fbfb0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0bc28f41b65b8e225e35493ee88fbfb0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0bc28f41b65b8e225e35493ee88fbfb0_JaffaCakes118
-
Size
48KB
-
MD5
0bc28f41b65b8e225e35493ee88fbfb0
-
SHA1
d8a92aac2b9884d72fd8d517a0a74a96aa4c874a
-
SHA256
e7e4ede41dfc293b56edaf42e75fbfe9d3dd167886609e3514b0286565357f84
-
SHA512
0da0b5b64f946533fa43155a5c8eeba30410874180d2ae9a3d4607cbd1016b257682661e57a6aa1bae60ebb171ee498d23382bb694c9971ca6c751edb8dd949e
-
SSDEEP
768:mRPyXHuttc8Yrsh8LhrLZugIvmSHrHglg5:m8HAtc8YDLhrLivmSHcl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bc28f41b65b8e225e35493ee88fbfb0_JaffaCakes118
Files
-
0bc28f41b65b8e225e35493ee88fbfb0_JaffaCakes118.exe windows:4 windows x86 arch:x86
feaa59a4c8b2c30ab928459480196043
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
recv
send
closesocket
connect
htons
getservbyname
socket
gethostbyaddr
gethostbyname
ioctlsocket
WSACleanup
WSAStartup
kernel32
GetEnvironmentStringsW
SetEndOfFile
HeapSize
LCMapStringW
LCMapStringA
GetLocaleInfoA
InterlockedExchange
RtlUnwind
LoadLibraryA
GetStringTypeW
GetStringTypeA
VirtualQuery
GetSystemInfo
VirtualProtect
Sleep
GetVolumeInformationA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
WideCharToMultiByte
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
GetLastError
WriteFile
HeapFree
CloseHandle
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
ReadFile
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
SetFilePointer
HeapAlloc
CompareStringA
MultiByteToWideChar
GetCPInfo
CompareStringW
GetACP
GetOEMCP
SetEnvironmentVariableA
CreateFileA
FlushFileBuffers
VirtualAlloc
HeapReAlloc
SetStdHandle
QueryPerformanceCounter
shell32
ShellExecuteA
Sections
.text Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE