Static task
static1
Behavioral task
behavioral1
Sample
579c76a735fd8d53f4731463096a79e6_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
579c76a735fd8d53f4731463096a79e6_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
579c76a735fd8d53f4731463096a79e6_JaffaCakes118
-
Size
143KB
-
MD5
579c76a735fd8d53f4731463096a79e6
-
SHA1
17bac06d246708335586273c4d1149dd42cf3618
-
SHA256
9e359005b4bc7f7f5db77c5448af5bf22fb71ecdd618b129b35cb6b07c452957
-
SHA512
f1d29bd55e86007e1d69028a31ee8c8ddbbda53d00f615746ef51b574b9f1a9b16b14e7c488ef3c75bc436861c2a11808fd5898fe8098ae7c88bc392954b7431
-
SSDEEP
3072:cltLV7H8x7nyQ7RSP8yEqGm88E35zEQTZugj/p6kiPEWU:clD7H8x7ynP8y1CZ2Qgsh2q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 579c76a735fd8d53f4731463096a79e6_JaffaCakes118
Files
-
579c76a735fd8d53f4731463096a79e6_JaffaCakes118.exe windows:5 windows x86 arch:x86
6b380a4d8aa7d11a257ea673ad26d220
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
QueryServiceConfigA
RegOpenKeyA
RegCloseKey
GetLengthSid
RegOpenKeyExW
RegEnumKeyExA
RegEnumKeyW
QueryServiceStatus
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW
AllocateAndInitializeSid
RegQueryValueA
GetTokenInformation
ElfRegisterEventSourceW
RegSetValueExW
EqualSid
RegQueryInfoKeyA
RegFlushKey
RegQueryInfoKeyW
RegEnumValueW
FreeSid
CreateServiceW
RegDeleteKeyW
RegEnumValueA
RegOpenKeyExA
RegSetValueExA
RegDeleteKeyA
RegCreateKeyW
RegQueryValueExW
kernel32
GetSystemTimeAsFileTime
GetStartupInfoW
GetFileType
lstrcmpiW
InterlockedIncrement
CreateFileW
lstrcmpiA
GetThreadLocale
GetOEMCP
HeapFree
VirtualAlloc
EnumResourceNamesA
CloseHandle
UnhandledExceptionFilter
HeapAlloc
GetProcessHeap
GetModuleHandleW
GetCurrentProcess
GetUserDefaultLCID
GetCurrentThread
GetFileSize
lstrcmpA
GetLastError
lstrcmpW
GetCurrentThreadId
GetTickCount
TerminateProcess
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetCurrentProcessId
fontsub
MergeFontPackage
CreateFontPackage
msvcrt
_abnormal_termination
malloc
_initterm
_wrmdir
free
_adjust_fdiv
psapi
GetDeviceDriverBaseNameA
GetProcessImageFileNameW
GetProcessMemoryInfo
GetModuleInformation
GetModuleFileNameExA
InitializeProcessForWsWatch
GetModuleBaseNameW
EnumProcesses
QueryWorkingSet
EmptyWorkingSet
EnumProcessModules
GetModuleBaseNameA
GetWsChanges
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ