Static task
static1
Behavioral task
behavioral1
Sample
30971caaf134d7706c70335f54e3188f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
30971caaf134d7706c70335f54e3188f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
30971caaf134d7706c70335f54e3188f_JaffaCakes118
-
Size
60KB
-
MD5
30971caaf134d7706c70335f54e3188f
-
SHA1
f0bd3007a4cf773302de52a736ba634bd368ef6d
-
SHA256
e7f8b95798656b83a4fe300a34fa20db484a3a11ada6193141452b20fa2c77af
-
SHA512
e31835c1d2bdba88183d4937436cbaa6aa5c4e4f7dd7cbc31cb5c6c90dc63087592a5f1f2886fe1f2e509450fe35116f2f012efa43fe813bd56a429ced84e73d
-
SSDEEP
1536:y9XrzqPWWzezTVI6gSjP6gWjltTaI3c1z2ehMSFSGot:y9zfgBXcTFSGot
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30971caaf134d7706c70335f54e3188f_JaffaCakes118
Files
-
30971caaf134d7706c70335f54e3188f_JaffaCakes118.exe windows:4 windows x86 arch:x86
84bd5fb4ea358278597a52057fe5e000
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
OpenProcess
GetModuleFileNameA
CloseHandle
GetLastError
CreateMutexA
lstrcatA
GetSystemDirectoryA
GetCurrentProcess
GetLocaleInfoA
GetACP
GetVersionExA
GetStringTypeA
LCMapStringW
LoadLibraryA
GetProcAddress
lstrcpyA
CreateRemoteThread
FreeLibrary
CreateProcessA
Sleep
LCMapStringA
MultiByteToWideChar
WriteFile
RtlUnwind
GetFileType
GetStringTypeW
GetStdHandle
SetHandleCount
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetCPInfo
GetOEMCP
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
user32
wsprintfA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
ws2_32
gethostname
WSACleanup
gethostbyname
WSAStartup
inet_ntoa
netapi32
Netbios
Sections
.text Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE