Static task
static1
Behavioral task
behavioral1
Sample
f1d29848f07d8c9678f48648ea147aa9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f1d29848f07d8c9678f48648ea147aa9_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
f1d29848f07d8c9678f48648ea147aa9_JaffaCakes118
-
Size
261KB
-
MD5
f1d29848f07d8c9678f48648ea147aa9
-
SHA1
75bdf394ae24d72ac53b7ad5d4c5e263848249a9
-
SHA256
4283985147d5bbe7a99e0c38d9ac5cb0ce3494323d3f570ce82eb0c5e51e1459
-
SHA512
85fb287412346195e4c58ea1110a378dae370b2c62032bec25d484ffe2ce41d1550b8bd93344a2fe9096d47d0254079c89a1c96d8b000cb1b88502e66988ebbd
-
SSDEEP
6144:nCFJwVUkbwB3bFUJoibYKeuld1TNexX16V2D:nukbk3bFco5klDTkxEV2D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f1d29848f07d8c9678f48648ea147aa9_JaffaCakes118
Files
-
f1d29848f07d8c9678f48648ea147aa9_JaffaCakes118.exe windows:5 windows x86 arch:x86
a764864066c479ad0d9889bdfe01ae60
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
recv
shutdown
bind
htons
WSASetLastError
setsockopt
getsockopt
ntohl
WSACancelBlockingCall
WSACleanup
socket
getservbyname
connect
gethostbyname
closesocket
htonl
ntohs
send
WSAGetLastError
accept
listen
inet_ntoa
WSAStartup
user32
MessageBoxIndirectA
kernel32
FreeLibrary
GetCurrentThreadId
SetLastError
GlobalMemoryStatus
FlushConsoleInputBuffer
CloseHandle
GetStdHandle
GetFileType
GetThreadTimes
GetLocalTime
VirtualAlloc
gdi32
CreateCompatibleBitmap
DeleteObject
BitBlt
GetDeviceCaps
CreateDCA
CreateCompatibleDC
SelectObject
GetBitmapBits
GetObjectA
DeleteDC
esent
JetCreateIndex
JetDupCursor
JetOSSnapshotThaw
JetGotoPosition
JetCreateTableColumnIndex2
JetDefragment
JetOpenTable
JetResetTableSequential
JetOSSnapshotPrepare
JetDupSession
JetCreateInstance
JetTruncateLogInstance
JetInit3
wshext
VerifyIndirectData
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 229KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ