Static task
static1
Behavioral task
behavioral1
Sample
563d15e24cb99bd4c0cf418f82d2e7c1_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
563d15e24cb99bd4c0cf418f82d2e7c1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
563d15e24cb99bd4c0cf418f82d2e7c1_JaffaCakes118
-
Size
70KB
-
MD5
563d15e24cb99bd4c0cf418f82d2e7c1
-
SHA1
22233a6738129ff8f70c4a48074f00b885506f03
-
SHA256
74fd2a3c1b0699eb4d9c118ab06177f4c2f7e1eab5dbcc083fd0f1d1cf7f0bf4
-
SHA512
0794ff4ec1aa5016ef5ebda9c15b42c124019c28859cc7d0ee59e325b7f99b2eb9fcc307756b7037730291e5d2677494ee7bf679944e14cdf3edfd4ba1467867
-
SSDEEP
1536:r4Eiaqyv2X6VWDMGje+m4YQnARObFnfdk/IsT1xWXU:X/lVIMGZmSAmFOIsT1xL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 563d15e24cb99bd4c0cf418f82d2e7c1_JaffaCakes118
Files
-
563d15e24cb99bd4c0cf418f82d2e7c1_JaffaCakes118.exe windows:5 windows x86 arch:x86
92058452f8baf6b2fcd9220c8da94ca0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
GetLastError
CopyFileA
SetFileAttributesA
GetFileAttributesA
lstrcmpiA
GetTempPathA
GetModuleFileNameA
GetModuleHandleA
ExpandEnvironmentStringsA
CloseHandle
ExitProcess
WriteFile
CreateFileA
ExitThread
lstrlenA
CreateDirectoryA
lstrcatA
GetDriveTypeA
GetLogicalDriveStringsA
CreateProcessA
CreateMutexA
SetErrorMode
Sleep
GetLocaleInfoA
GetTickCount
ReadFile
GetProcessHeap
SetEndOfFile
HeapReAlloc
GetStringTypeW
LCMapStringW
MultiByteToWideChar
WriteConsoleW
HeapSize
FlushFileBuffers
SetStdHandle
LoadLibraryW
IsValidCodePage
GetOEMCP
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetProcAddress
GetStdHandle
GetModuleFileNameW
HeapCreate
IsProcessorFeaturePresent
HeapFree
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
RtlUnwind
RaiseException
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
CreateFileW
user32
wsprintfA
advapi32
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
shell32
ShellExecuteA
ws2_32
recv
select
send
socket
connect
WSAStartup
WSACleanup
closesocket
inet_addr
gethostbyname
sendto
htons
shlwapi
PathRemoveFileSpecA
urlmon
URLDownloadToFileA
Sections
.text Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ