Static task
static1
Behavioral task
behavioral1
Sample
409c7d02f5077182c8adb39d0d70ce85_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
409c7d02f5077182c8adb39d0d70ce85_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
409c7d02f5077182c8adb39d0d70ce85_JaffaCakes118
-
Size
24KB
-
MD5
409c7d02f5077182c8adb39d0d70ce85
-
SHA1
a0132ded4d43f9207b5ccb11e04bcd1347bd8640
-
SHA256
ee48ab58d9c0ad8018281dca77263da841102d07d7db3392464462726f857c25
-
SHA512
5e626ff6fc9e8cadec21adcbdc7ce2d5be30c438433db143f04ed2ca9949856d5a6ec72ac5308c9cdbd1e339650ea1f10ef71d7e3219d39e0ed5297174bd8d84
-
SSDEEP
384:a9hxa1CQL+a3KFWs2crqhRyU4MEJUPsmjG0tio7ZMitM6e9FLe1tJToyoU:Exa1CQaBFWPwqx4MEJ4smjG0tiktMt9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 409c7d02f5077182c8adb39d0d70ce85_JaffaCakes118
Files
-
409c7d02f5077182c8adb39d0d70ce85_JaffaCakes118.exe windows:4 windows x86 arch:x86
9e029c18a437c3456e7b3238d643070d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
urlmon
Extract
CreateAsyncBindCtx
DllCanUnloadNow
IsAsyncMoniker
ZonesReInit
IsValidURL
URLDownloadW
wsock32
accept
bind
htons
sethostname
WSAStartup
htonl
SetServiceA
gethostbyaddr
listen
Sections
.text Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE