Static task
static1
Behavioral task
behavioral1
Sample
56f9ecd71abd97905de3e5b621226f04_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
56f9ecd71abd97905de3e5b621226f04_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
56f9ecd71abd97905de3e5b621226f04_JaffaCakes118
-
Size
132KB
-
MD5
56f9ecd71abd97905de3e5b621226f04
-
SHA1
f7f82e7ae3cce0ae3f85eb3113a60296c45a38de
-
SHA256
dc0b01d0839069392d1981731a1e8e9379a300b8f788975803781cad240e2e07
-
SHA512
a27d81d8f66b01edf57778f37738a25c761c29952114eea56319c6f071d4257995176b99fb6b76e9ca9c21bd9ae635c46e3bfe9aefbe44aa31d303985871457d
-
SSDEEP
3072:jIpItspWo6hSTBfCkRC5bSZ661Fx8HwtT9EW8zQMU3s:NtspW5hSTB6kRC5Q66TxHp8e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 56f9ecd71abd97905de3e5b621226f04_JaffaCakes118
Files
-
56f9ecd71abd97905de3e5b621226f04_JaffaCakes118.exe windows:4 windows x86 arch:x86
3cf147645e3fd4d8b1904aa6c6f21935
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
strncpy
strrchr
srand
??2@YAPAXI@Z
memmove
strstr
memset
strchr
_except_handler3
tolower
memcpy
__CxxFrameHandler
rand
malloc
free
_itoa
_strrev
_strlwr
_ftol
strlen
kernel32
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
IsBadWritePtr
GetTickCount
GetModuleFileNameA
GetCommandLineA
CopyFileA
SetFilePointer
GetStartupInfoA
CreateProcessA
SetUnhandledExceptionFilter
SleepEx
ExpandEnvironmentStringsA
GetShortPathNameA
Sleep
CreateEventA
WaitForSingleObject
lstrlenA
CreateFileA
GetCurrentProcessId
GetCurrentThreadId
WriteFile
MoveFileA
GetTempPathA
GetCurrentDirectoryA
GetProcAddress
LoadLibraryA
ExitProcess
GetModuleHandleA
GetCurrentProcess
CloseHandle
GetLastError
CreateDirectoryA
DeleteFileA
SetFileAttributesA
GetFileAttributesA
GetSystemDirectoryA
ws2_32
closesocket
getprotobynumber
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ