Static task
static1
Behavioral task
behavioral1
Sample
44f4dad2981d4d1148979e9656e06dd7_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
44f4dad2981d4d1148979e9656e06dd7_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
44f4dad2981d4d1148979e9656e06dd7_JaffaCakes118
-
Size
255KB
-
MD5
44f4dad2981d4d1148979e9656e06dd7
-
SHA1
752c337c7f42d742b96ba5cb93131eee0fe96c57
-
SHA256
0f84a69e46bb671c4df2877d7596b4f51b32672c9c861ae6add31632f12281c1
-
SHA512
3aaad9fe127591df01186ea76b73a5674ad5ba9052ba4fb4e72d5bcde091eb76f1d4eb80ff333a13058c321a21d3bd10aafe4a4475f003201635d61d1f824801
-
SSDEEP
3072:bUtYigBbkm8IrEZFV4Vpt7l3FkMuucN6MLaAXLJ6YZq4TXJAMGaz7HVTQ6zIIo4P:Y+4mkluAaAXLNZGazgWi0BaeyAUQP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44f4dad2981d4d1148979e9656e06dd7_JaffaCakes118
Files
-
44f4dad2981d4d1148979e9656e06dd7_JaffaCakes118.exe windows:4 windows x86 arch:x86
86e93c5ab9ed553e40b4c538c03bc05d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCloseKey
kernel32
AddAtomA
CloseHandle
CopyFileA
CopyFileW
CreateDirectoryA
CreateDirectoryW
CreateEventA
CreateFileA
CreateFileW
CreateMutexA
CreateSemaphoreA
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExitProcess
FindAtomA
FindClose
FindFirstFileW
FindNextFileW
FreeLibrary
GetAtomNameA
GetCurrentDirectoryW
GetCurrentThreadId
GetFileSize
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemDirectoryW
GetTempPathW
GetTickCount
GetVersionExW
GlobalAlloc
GlobalFree
GlobalMemoryStatusEx
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
LoadLibraryA
LocalFileTimeToFileTime
MoveFileW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryW
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
SetEvent
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrlenA
msvcrt
_write
__getmainargs
__p__environ
__p__fmode
__set_app_type
_beginthread
_cexit
_i64tow
_iob
_itow
_onexit
_setmode
_timezone
_wtof
_wtoi
_wtoi64
abort
atexit
calloc
fputc
fputs
free
fwrite
localtime
malloc
memchr
memcmp
memcpy
memmove
mktime
printf
realloc
signal
sprintf
strcat
strcmp
strcpy
strerror
swprintf
time
vfprintf
ole32
CoCreateGuid
CoInitialize
CoUninitialize
user32
MessageBoxW
wsock32
WSACleanup
WSAGetLastError
WSAStartup
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
gethostname
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
recv
select
send
setsockopt
shutdown
socket
Sections
.text Size: 223KB - Virtual size: 223KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 1024B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 18KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ