Static task
static1
Behavioral task
behavioral1
Sample
45846b1713b80d2c4a8617f31072df74_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
45846b1713b80d2c4a8617f31072df74_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
45846b1713b80d2c4a8617f31072df74_JaffaCakes118
-
Size
100KB
-
MD5
45846b1713b80d2c4a8617f31072df74
-
SHA1
595e449aaad8238756bf6dfd77fe5c2f84bf00d1
-
SHA256
d8b62b0859bbeb05b74807f274b863def95fcbaf51440092c30ffc201aabe4bf
-
SHA512
6e05b6836cbeadc34de3571f97ce827e493a95008a8ffb73e1c06b980a1bf0426fcff418d1c58b6bab0fe7218c554c51f4750d28f5c4363fbc5240010141db6a
-
SSDEEP
1536:QmvBStbPLKriwmlpDTOQWTtMM+ILfPvPoU/:QIB+rlu5xvPoU/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 45846b1713b80d2c4a8617f31072df74_JaffaCakes118
Files
-
45846b1713b80d2c4a8617f31072df74_JaffaCakes118.exe windows:4 windows x86 arch:x86
1c3d9548cbac0d771bdb7b79ad952c97
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSAStartup
inet_addr
closesocket
gethostbyname
select
send
recv
WSAGetLastError
bind
listen
accept
socket
htons
connect
ioctlsocket
setsockopt
ntohs
kernel32
GetCPInfo
GetStringTypeW
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
WriteFile
CreateFileA
GetTempFileNameA
GetTempPathA
WaitForMultipleObjects
DeleteFileW
Sleep
GetTickCount
CreateThread
GetComputerNameW
ReadFile
SetFilePointer
GetFileSize
CreateFileW
GetWindowsDirectoryW
GetModuleFileNameW
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
OpenProcess
TerminateProcess
CreateProcessA
GetStartupInfoA
CreatePipe
GetWindowsDirectoryA
GetACP
PeekNamedPipe
FileTimeToSystemTime
FindClose
FindNextFileW
FindFirstFileW
GetDriveTypeA
LoadLibraryW
CreateProcessW
GetLastError
MoveFileExA
DeleteFileA
GetModuleFileNameA
ResumeThread
SetThreadContext
FlushInstructionCache
WriteProcessMemory
VirtualProtectEx
GetThreadContext
DuplicateHandle
ExitProcess
RemoveDirectoryA
WaitForSingleObject
FlushFileBuffers
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
GetOEMCP
LCMapStringA
LCMapStringW
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
SetStdHandle
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
HeapReAlloc
HeapSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
advapi32
RegQueryValueExA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
DeleteService
RegSetValueExA
SetTokenInformation
CreateProcessAsUserA
DuplicateTokenEx
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumKeyA
RegOpenKeyExA
RegCloseKey
iphlpapi
SetTcpEntry
GetTcpTable
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE