Behavioral task
behavioral1
Sample
dacf0a692f819a931e0311d5849bffd4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dacf0a692f819a931e0311d5849bffd4_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
dacf0a692f819a931e0311d5849bffd4_JaffaCakes118
-
Size
33KB
-
MD5
dacf0a692f819a931e0311d5849bffd4
-
SHA1
e374c211e5b648146ee6aa4472833562c4b81b39
-
SHA256
aaf49932e8e545f0c374716f73dea7e0bb6c1ca7a7a20b0e975fa0de1aac058f
-
SHA512
1adf13c8bcb40f7896a74767bf743faa22c31082f46d7893dc42f7ee043b32b30e8d14efc9b8979aebfe077ff1d3e94163add4d5a51aa913cdeb7454b92e6024
-
SSDEEP
384:v3GD/a/U9+i/G11K1i86pZWttZ0u/uWcvaChiYLZLC/AYOKYONfEgn5bYLIVzqSf:v5M+i/G1zYM4dkirwC5bVzbKBfPgMFm
Malware Config
Signatures
-
Detects Kaiten/Tsunami Payload 1 IoCs
resource yara_rule sample family_kaiten2 -
Kaiten family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dacf0a692f819a931e0311d5849bffd4_JaffaCakes118
Files
-
dacf0a692f819a931e0311d5849bffd4_JaffaCakes118.exe windows:4 windows x86 arch:x86
3183b6b50066deeb53760909d3e9930c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
cygwin1
__errno
__main
_fopen64
_impure_ptr
accept
atoi
atol
bcopy
bind
calloc
close
connect
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fgets
fork
fputc
free
gethostbyname
getpid
getppid
htons
inet_addr
inet_network
ioctl
kill
listen
malloc
memcpy
memset
ntohl
pclose
popen
rand
realloc
recv
select
sendto
setsockopt
sleep
socket
sprintf
srand
strcasecmp
strcat
strcpy
strdup
strlen
strncmp
strncpy
strtok
time
toupper
vsprintf
waitpid
write
kernel32
GetModuleHandleA
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE