Static task
static1
Behavioral task
behavioral1
Sample
52bb841adb170b77c5d0bdb299c6747b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
52bb841adb170b77c5d0bdb299c6747b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
52bb841adb170b77c5d0bdb299c6747b_JaffaCakes118
-
Size
29KB
-
MD5
52bb841adb170b77c5d0bdb299c6747b
-
SHA1
4f7cdec62adbc7491d395078b0ba60566b4081e0
-
SHA256
edb861aa742245b1575c5d50323c8f7a6cb25150436e16f1db48c4138dea3100
-
SHA512
455875f29542b613dc67e74667ae42adc1688e4a1cffff720f0f0741dfbb22c7235caa0bf13136f1d22d9e175077c576f857a6f48d6fef8a99345fc2d5c13460
-
SSDEEP
384:PuHA+opwkvhGDcYAjNvRoNpvz/Oa1yAHRl8LL2cOIOAIN7I+YIFI2qnjmAuYMrEx:PuHspwkEDcuvLigiNLg4C0z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52bb841adb170b77c5d0bdb299c6747b_JaffaCakes118
Files
-
52bb841adb170b77c5d0bdb299c6747b_JaffaCakes118.exe windows:4 windows x86 arch:x86
eb82415cfdf067fefe0a70a28aab52c8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WinExec
FindClose
FindFirstFileA
ResumeThread
SetThreadPriority
GetCurrentThread
SetPriorityClass
lstrcatA
SetFileAttributesA
GetShortPathNameA
GetModuleFileNameA
lstrlenA
GetLastError
CopyFileA
GetSystemDirectoryA
GetModuleHandleA
GlobalMemoryStatus
GetTickCount
GetComputerNameA
GetVersionExA
GetTempPathA
DeleteFileA
CreateProcessA
ExitProcess
GetCurrentProcess
lstrcpyA
CreateThread
LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
ExitThread
GetEnvironmentVariableA
GetStartupInfoA
user32
ExitWindowsEx
wsprintfA
advapi32
OpenSCManagerA
OpenServiceA
StartServiceA
RegOpenKeyA
RegSetValueExA
CloseServiceHandle
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
CreateServiceA
shell32
ShellExecuteA
ws2_32.dll�
ord52
ord12
ord4
ord19
ord3
ord16
WSASocketA
ord21
ord9
ord11
ord8
ord20
ord116
ord115
ord111
ord23
wininet
DeleteUrlCacheEntry
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_except_handler3
strncmp
exit
malloc
sprintf
time
srand
strstr
rand
printf
strncpy
strcspn
Sections
.data Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE