Static task
static1
Behavioral task
behavioral1
Sample
97a3f6dc1bce3b06b70276d5a50ce4ba_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
97a3f6dc1bce3b06b70276d5a50ce4ba_JaffaCakes118
-
Size
321KB
-
MD5
97a3f6dc1bce3b06b70276d5a50ce4ba
-
SHA1
3cf52524694a93ec004ad9b6a228c527b8458e3f
-
SHA256
e3deeec42d74b4cfe8f2e0bec4c255ef25450b81f561c4f1d4575f342609cc30
-
SHA512
c7cb5b13c54995b90137b7843636726902ab8fa15b694f854f3895a0fa11189abc71639fe544ecaedd28c2d2544b4b94a8864b172e624513021d727cc7edfd73
-
SSDEEP
6144:rkqnAx/UwzdW9/f4nHPdbP441keMEUpXI2ODFZsrsIhs/EbBK0HV/:AqaUwQ9nEdxrHzsofCtV/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 97a3f6dc1bce3b06b70276d5a50ce4ba_JaffaCakes118
Files
-
97a3f6dc1bce3b06b70276d5a50ce4ba_JaffaCakes118.exe windows:5 windows x86 arch:x86
6f3a6fd412b8c5b4bb78abd28e53354c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
clbcatq
CoRegCleanup
ComPlusMigrate
SetSetupSave
SetSetupOpen
DowngradeAPL
crypt32
CryptMsgGetParam
CertFreeCTLContext
CertGetStoreProperty
CertCreateCRLContext
CertGetNameStringA
CertOpenStore
CertFindCTLInStore
CryptMsgUpdate
CryptMemAlloc
CertDeleteCTLFromStore
CryptMsgControl
CertAlgIdToOID
CertCloseStore
cryptdll
MD5Init
MD5Update
MD5Final
CDBuildVect
CDLocateRng
advapi32
RegEnumKeyA
CreateServiceW
RegOpenKeyA
RegSaveKeyA
LogonUserA
RegLoadKeyW
GetUserNameA
RegRestoreKeyW
RegUnLoadKeyW
CryptSignHashA
ReadEventLogA
OpenEventLogA
RegDeleteValueW
user32
MessageBoxA
GetWindow
InsertMenuA
IsWindowVisible
GetMessageW
DispatchMessageW
GetDlgItemTextW
DialogBoxParamA
LoadMenuW
CharToOemA
CreateDesktopW
DrawStateA
IsDialogMessageW
GetClassLongA
kernel32
WriteFile
LoadLibraryExA
GetCommandLineW
OpenEventW
GetLogicalDriveStringsW
lstrlen
LeaveCriticalSection
WaitForSingleObject
CreateMutexW
GetCommandLineA
GetModuleHandleA
GetStringTypeW
GetConsoleAliasA
lstrcmp
Heap32Next
CreateFileW
GetOEMCP
GetProcAddress
Sections
.text Size: 301KB - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ