Static task
static1
Behavioral task
behavioral1
Sample
noe6x.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
noe6x.exe
Resource
win10v2004-20240226-en
General
-
Target
8fd3e9b63f9d286a1b41bb89607bca0a_JaffaCakes118
-
Size
276KB
-
MD5
8fd3e9b63f9d286a1b41bb89607bca0a
-
SHA1
936929545af7a6dcdf853319dcae9b745824f716
-
SHA256
bf6dfcd16cec6985a33428196c3f195354bc259efefd67e8779c3caf6a9b3080
-
SHA512
2d61df99ed5cf74ae9fc5d04c43459d79e20710c3a3b6e24238cd64d343f5b700ade8560ae356e18dab47887bb081ac81277f5610c5f2f16cbd3d3363dc3f822
-
SSDEEP
6144:H8mtwFTuav6B/ENhn8RZZ/hVXB4il1q3+v9Lh/cVb4:H8mRHcNhn8ZthVx3l1q3i9r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/noe6x.exe
Files
-
8fd3e9b63f9d286a1b41bb89607bca0a_JaffaCakes118.zip
Password: infected
-
noe6x.exe.exe windows:5 windows x86 arch:x86
05b8c06fd2a2a4354e012d1e4422bfc8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
WriteFile
lstrcmpW
LocalFree
lstrlenW
VirtualAlloc
VirtualFree
LocalAlloc
LoadLibraryA
HeapDestroy
HeapCreate
GlobalUnlock
GlobalSize
GlobalLock
ExitProcess
SetHandleCount
GlobalFree
GlobalAlloc
GetStdHandle
GetProcAddress
GetLocaleInfoW
GetLastError
GetFileType
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
lstrcpyW
user32
LoadCursorA
LoadIconA
MessageBoxA
LoadStringA
ExitWindowsEx
CharPrevA
CharNextA
gdi32
GetStockObject
advapi32
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid
AdjustTokenPrivileges
RegEnumKeyA
RegEnumValueA
RegOpenKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
Sections
.textR Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 279KB - Virtual size: 278KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata2 Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ