Static task
static1
Behavioral task
behavioral1
Sample
16cf8ee40fac521a7ff1c4227bd6bb5a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
16cf8ee40fac521a7ff1c4227bd6bb5a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
16cf8ee40fac521a7ff1c4227bd6bb5a_JaffaCakes118
-
Size
13KB
-
MD5
16cf8ee40fac521a7ff1c4227bd6bb5a
-
SHA1
81cc0c5cdc66d25af0bc771b96a433500da8a22d
-
SHA256
caeec506089fcf84407a2eb181ee056c284afae8523aa72d6018a0aa48e90ab2
-
SHA512
56c326cdeb8ef9371b26771c3ac701832fe5932d69a269704a5e7848a02c6f35951c31e461ea58b7cf90ac4903faaa9f136071b78c7b5ab5d664c2b805ed02c2
-
SSDEEP
384:FdBOQ29c7FXXZNJhCW4amqZbfYM3zTAN6xN+FeOdZft6Ng:FdBOQ29c7FXXZNJhCW4amqZbTZODft6C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16cf8ee40fac521a7ff1c4227bd6bb5a_JaffaCakes118
Files
-
16cf8ee40fac521a7ff1c4227bd6bb5a_JaffaCakes118.exe windows:1 windows x86 arch:x86
cf921f0db88fa93d18973ae4b7df0c76
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
WSACleanup
WSAStartup
accept
bind
closesocket
htonl
htons
listen
recv
select
send
socket
urlmon
URLDownloadToFileA
kernel32
ExitThread
FreeLibrary
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetLastError
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetVersionExA
LoadLibraryA
OpenProcess
PeekNamedPipe
ReadFile
RtlUnwind
Sleep
TerminateProcess
TerminateThread
WaitForMultipleObjects
CreatePipe
WinExec
CreateProcessA
WriteFile
lstrlenA
CreateThread
DisconnectNamedPipe
DuplicateHandle
user32
ExitWindowsEx
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
OpenSCManagerA
OpenServiceA
RegCloseKey
RegDeleteValueA
RegOpenKeyA
RegSetValueExA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
CloseServiceHandle
CreateServiceA
DeleteService
crtdll
__GetMainArgs
_strnicmp
atoi
exit
free
malloc
memcpy
memset
raise
signal
strcat
strchr
strcmp
strpbrk
strstr
strtok
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE