Static task
static1
Behavioral task
behavioral1
Sample
1478395cbaf86ff729d25e260385d4b0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1478395cbaf86ff729d25e260385d4b0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
1478395cbaf86ff729d25e260385d4b0_JaffaCakes118
-
Size
62KB
-
MD5
1478395cbaf86ff729d25e260385d4b0
-
SHA1
20093be99b74ff99e2172e3f25e5fa9a1e6b6be9
-
SHA256
34f979f3d95317a8045b5777b836bb5d6ebd8b51cacf67c7def5d440bb0ae6cf
-
SHA512
801e309381094ea2f5cbe8fba28abb26e07d8048b70f504fc16ec6abaeef52317c6c0b939a2aa017bbe66854ce7f791d52a96a5f36b3349c4785330b49d9a47f
-
SSDEEP
1536:nhCushjUJRaTEtCLDdo1otlo4k1ZRDejlsX5DqouOtNGxi:Q7hjUxKBoitloX3ChgqouOtNG8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1478395cbaf86ff729d25e260385d4b0_JaffaCakes118
Files
-
1478395cbaf86ff729d25e260385d4b0_JaffaCakes118.exe windows:4 windows x86 arch:x86
ced2d01e252a7b3243d39258807a9f07
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
shlwapi
wnsprintfA
StrStrIA
StrStrA
ws2_32
send
recv
socket
closesocket
setsockopt
getsockname
connect
htons
recvfrom
sendto
inet_ntoa
getsockopt
WSAStartup
wininet
HttpSendRequestA
InternetConnectA
InternetOpenA
HttpQueryInfoA
InternetCloseHandle
HttpOpenRequestA
InternetReadFile
kernel32
MultiByteToWideChar
GlobalAlloc
GlobalFree
lstrcmpW
GetSystemTime
GetSystemDirectoryA
OpenFile
SetFilePointer
WriteFile
CreateProcessA
WriteProcessMemory
CreateRemoteThread
CreateToolhelp32Snapshot
OpenProcess
VirtualAllocEx
Process32Next
GetLastError
GetTimeZoneInformation
GetCommandLineA
GetVersion
MapViewOfFile
CreateFileMappingA
ExitProcess
ExitThread
Sleep
TerminateThread
OpenThread
GetCurrentThreadId
CloseHandle
CreateThread
CreateMutexA
OpenMutexA
lstrcmpA
lstrlenW
IsBadReadPtr
lstrcmpiA
GetTickCount
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
IsBadWritePtr
WaitForSingleObject
ReleaseMutex
SystemTimeToFileTime
user32
CharLowerA
GetDC
wsprintfA
dnsapi
DnsQuery_A
DnsExtractRecordsFromMessage_W
DnsRecordListFree
gdiplus
GdipDeletePen
GdipDeleteGraphics
GdipGetFontCollectionFamilyCount
GdipCreatePen1
GdipPrivateAddMemoryFont
GdipDeleteFont
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDisposeImage
GdipSaveImageToStream
GdipGetImageWidth
GdipDeleteBrush
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetDC
GdipReleaseDC
GdipDrawLineI
GdipFillRectangleI
GdipDrawString
GdipDrawImageI
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipDeletePrivateFontCollection
GdipCreateFont
GdipCloneBitmapAreaI
GdipCloneBrush
GdipCloneImage
GdipAlloc
GdipFree
GdipGetImageHeight
GdipNewPrivateFontCollection
gdi32
GetTextExtentPoint32A
ole32
CreateStreamOnHGlobal
shell32
ShellExecuteA
Sections
.text Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 21.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE