Static task
static1
Behavioral task
behavioral1
Sample
6b09ec89d6c9e858cce32e68269b2986_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
6b09ec89d6c9e858cce32e68269b2986_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
6b09ec89d6c9e858cce32e68269b2986_JaffaCakes118
-
Size
29KB
-
MD5
6b09ec89d6c9e858cce32e68269b2986
-
SHA1
00ec3008e7dc9704fedb95b0110bd306208ce686
-
SHA256
225370c98e66e595efd418a2143ef533feea099e8e05d99a79e4572bcd3e4477
-
SHA512
95d66e66148c882fd0dab781817f65060a78c60f3b658cfaf1dd8d8ed1cef21cdf02f31a8cc473e368df783995b3b1a128e6df8b03a1b716a20a4f3457b313ea
-
SSDEEP
768:+4cQzFxAuRCTwZGvRfC6I+79EDYoM7DdWh:+TQFCuRGH4+xSYxWh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6b09ec89d6c9e858cce32e68269b2986_JaffaCakes118
Files
-
6b09ec89d6c9e858cce32e68269b2986_JaffaCakes118.exe windows:4 windows x86 arch:x86
12d709cd7efb5ba33ea40cf4179c9b93
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
advapi32
CopySid
netapi32
NetGroupEnum
msys-2.0
exit
Sections
.MPRESS1 Size: 24KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE