time
Static task
static1
Behavioral task
behavioral1
Sample
561c1f3355fb9fad1a0f56cff591ca86_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
561c1f3355fb9fad1a0f56cff591ca86_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
561c1f3355fb9fad1a0f56cff591ca86_JaffaCakes118
-
Size
76KB
-
MD5
561c1f3355fb9fad1a0f56cff591ca86
-
SHA1
1e83e321201360d308c942ad34bd23bb860d15d0
-
SHA256
5a2dfb24e8a28d23ac593a6fa5ae00540662da99f8bd509159f6b77b55987870
-
SHA512
0384f907a7c330146c94f6f6b322a82ebd7dd8cd9fddfc0b9737aee0afb05738c60ffc3f3135ace584905dd0fe602cb2bfaeea6aba9c34a0d2a9bdba44a25a8d
-
SSDEEP
1536:W/NLmSQaQY6QPbFUDVQvh55Jlt7Y/YCNTMdW4:W/NLmaJ+Dmvh5HA1cf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 561c1f3355fb9fad1a0f56cff591ca86_JaffaCakes118
Files
-
561c1f3355fb9fad1a0f56cff591ca86_JaffaCakes118.exe windows:4 windows x86 arch:x86
70290b5c68f6ff65eccef5431c4d8a8e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
closesocket
WSAStartup
bind
listen
accept
inet_addr
gethostbyname
socket
setsockopt
htons
recv
connect
WSAGetLastError
shutdown
select
__WSAFDIsSet
send
inet_ntoa
kernel32
DeleteCriticalSection
GetCommandLineA
GlobalAlloc
CreateMutexA
CopyFileA
InitializeCriticalSection
CreateThread
ExitThread
Sleep
WaitForSingleObject
GetCurrentThread
GetCurrentProcess
GetTickCount
GetLastError
TerminateThread
GetCurrentThreadId
GetProcessHeap
GetVersion
GetCurrentProcessId
advapi32
RegCloseKey
RegCreateKeyExA
RegEnumValueA
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
msvcrt
strlen
strcat
rand
realloc
atoi
strchr
strstr
strcpy
_snprintf
free
gmtime
malloc
_time64
_spawnl
sscanf
strncpy
srand
strtok
strrchr
sprintf
exit
_fullpath
_execl
fwrite
fclose
fread
_filelength
fopen
strncmp
isdigit
_strrev
Exports
Exports
Sections
.text Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE