Static task
static1
Behavioral task
behavioral1
Sample
84255e080413cc079085e8f879be7c66_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
84255e080413cc079085e8f879be7c66_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
84255e080413cc079085e8f879be7c66_JaffaCakes118
-
Size
136KB
-
MD5
84255e080413cc079085e8f879be7c66
-
SHA1
4e163a6b5fd450392e1a4a67b67bf43eb0cc80b7
-
SHA256
f10b952d03c6c2ced1d2a0ea27a6572a38227c0c66a0d80be8e7976513270bc6
-
SHA512
3272fe2329622c262765c5c6202030533ef26ccbf90ca42c5299f3816f22cceb631ec9d4fa0b1b6bf06cb9fb410e3e36042ed06d5afe93fea78cdc74a6f31492
-
SSDEEP
3072:+zb+xJSz6iy/eRft8ttGA/Xr3E3GKinU6tIVJ7PiOKx1gwkGXPyK:+zSxonymht4rzKAUfVpiOKxV3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 84255e080413cc079085e8f879be7c66_JaffaCakes118
Files
-
84255e080413cc079085e8f879be7c66_JaffaCakes118.exe windows:5 windows x86 arch:x86
c7e379d27f7f908050d1d26d98782f47
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htons
getpeername
WSALookupServiceNextW
WSACleanup
gethostname
GetNameInfoW
select
ioctlsocket
socket
recv
WSAGetOverlappedResult
WSASend
WSACancelBlockingCall
connect
WSCWriteNameSpaceOrder
gethostbyname
WPUCompleteOverlappedRequest
recvfrom
WSAGetServiceClassNameByClassIdA
WSCDeinstallProvider
WSAGetLastError
__WSAFDIsSet
send
WSALookupServiceBeginW
getsockname
WSALookupServiceEnd
sendto
WSAStartup
getsockopt
setsockopt
azroles
AzInitialize
DllUnregisterServer
AzGroupOpen
DllRegisterServer
AzGroupDelete
gdi32
DdEntry50
GdiGradientFill
GetEUDCTimeStampExW
CreateICW
CreateICA
CreateDCA
CreateRectRgnIndirect
GdiConvertRegion
kernel32
VirtualAlloc
GetEnvironmentStrings
SetHandleCount
GetOEMCP
GetStartupInfoA
GetSystemInfo
GetModuleHandleW
GetEnvironmentStringsW
lstrcmpA
GetSystemTimeAsFileTime
GetStringTypeA
FreeEnvironmentStringsA
GetACP
GetCurrentThreadId
FreeEnvironmentStringsW
GetStringTypeW
LCMapStringW
lstrcmpiA
ContinueDebugEvent
LCMapStringA
GetVersion
DeleteFileA
HeapCreate
GetLocalTime
user32
GetClientRect
FindWindowA
DrawMenuBar
VkKeyScanExW
InvalidateRect
GetFocus
GetCursorPos
FindWindowW
LoadAcceleratorsW
mspatcha
GetFilePatchSignatureByHandle
GetFilePatchSignatureA
ApplyPatchToFileByHandlesEx
ApplyPatchToFileExW
TestApplyPatchToFileA
TestApplyPatchToFileW
ApplyPatchToFileW
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ