Static task
static1
Behavioral task
behavioral1
Sample
3c4af145dfd08cefca0b030db595d355_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3c4af145dfd08cefca0b030db595d355_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3c4af145dfd08cefca0b030db595d355_JaffaCakes118
-
Size
53KB
-
MD5
3c4af145dfd08cefca0b030db595d355
-
SHA1
5bb1882d6fe889a80e1f75ed93e5f02132f024a4
-
SHA256
c8dbdb5db02ff0af3193f5e17285808486469fa062d65a041bcd35d5be230d75
-
SHA512
49843d28e8e09d6f002abae7b45a784a454cdefff17be28127f4a3b17be937c93c7dc9203c643e2342de8b0cc79dc0f4594d16cb62d4199581395f6fa7bb8ebd
-
SSDEEP
1536:CpvuCYZTm157hOLSSSSSSSSdC7zDNvYrFUnOjSC:auxZq770ZC7zpvYr+nMp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c4af145dfd08cefca0b030db595d355_JaffaCakes118
Files
-
3c4af145dfd08cefca0b030db595d355_JaffaCakes118.exe windows:4 windows x86 arch:x86
19e904598f8e081c7a74432e7a873305
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32Next
Process32First
CreateToolhelp32Snapshot
GetVolumeInformationA
GetComputerNameA
GetModuleFileNameA
GetSystemDirectoryA
DeleteFileA
GetWindowsDirectoryA
ResumeThread
SetThreadPriority
CreateProcessA
SetPriorityClass
GetCurrentProcess
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
CreateThread
ExitProcess
CopyFileA
GetModuleHandleA
GetStartupInfoA
CloseHandle
GetSystemTime
Sleep
LoadLibraryA
GetCurrentThread
GetProcAddress
user32
GetWindowTextA
EnumWindows
advapi32
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
msvcrt
__p__fmode
??3@YAXPAX@Z
fclose
fwrite
fopen
sprintf
rand
time
fread
fseek
strstr
??2@YAPAXI@Z
_except_handler3
fputs
fgets
exit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
srand
__set_app_type
_controlfp
wininet
InternetCloseHandle
InternetReadFile
InternetOpenA
InternetOpenUrlA
winmm
timeGetTime
netapi32
Netbios
ws2_32
inet_addr
connect
htons
socket
WSAStartup
send
gethostbyname
Sections
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ