Static task
static1
Behavioral task
behavioral1
Sample
13648d927489b0afc0c8bb0d899e24fa_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
13648d927489b0afc0c8bb0d899e24fa_JaffaCakes118
-
Size
192KB
-
MD5
13648d927489b0afc0c8bb0d899e24fa
-
SHA1
5edbb2c753f8ca0d3b8393c5c8d147b321bbf129
-
SHA256
b3b4e38a944e98344fd56590c5cd45eeaa3f9e41c94eda17df64916926872c97
-
SHA512
ad91f6f52b7f9e4a662c2075ebfabc45cf57cb40b5c84c6bc351094ed1ead24d13678fff1d290902484660e8e5a0738e70347edd1f20b99a164ae5f21e4c2a70
-
SSDEEP
3072:v7xkpsvRPsLrsr2GsRBtk9PJ1WXhuLca/Nx:jSpsvRmrRwhQXh2f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 13648d927489b0afc0c8bb0d899e24fa_JaffaCakes118
Files
-
13648d927489b0afc0c8bb0d899e24fa_JaffaCakes118.exe windows:4 windows x86 arch:x86
4bf44346e7456b1e95844c45133bc072
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memset
__CxxFrameHandler
memmove
srand
rand
_except_handler3
_ftol
tolower
strncmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_controlfp
_itoa
advapi32
QueryServiceConfigA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenServiceA
QueryServiceStatus
ControlService
CreateServiceA
DeleteService
CloseServiceHandle
RegSaveKeyA
RegRestoreKeyA
ChangeServiceConfig2A
OpenSCManagerA
StartServiceA
ChangeServiceConfigA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
shlwapi
SHDeleteKeyA
SHCopyKeyA
SHGetValueA
PathFileExistsA
user32
GetActiveWindow
wsprintfA
FlashWindow
kernel32
GetCommandLineA
CreateProcessA
SetUnhandledExceptionFilter
CreateThread
GetExitCodeThread
ExitThread
IsBadReadPtr
SleepEx
SetEnvironmentVariableA
GetSystemDirectoryA
ExpandEnvironmentStringsA
CreateEventA
GetCurrentProcess
WaitForSingleObject
CreateFileA
SetFilePointer
WriteFile
CloseHandle
GetTempPathA
GetCurrentDirectoryA
LoadLibraryA
Sleep
GetLastError
GetModuleHandleA
GetProcAddress
GetFileAttributesA
SetFileAttributesA
DeleteFileA
CreateDirectoryA
GetModuleFileNameA
GetCurrentThreadId
GetStartupInfoA
CopyFileA
ExitProcess
GetTickCount
IsBadWritePtr
ws2_32
getprotobynumber
closesocket
Sections
CODE Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 164KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ