??0CVssJetWriter@@QAE@XZ
Static task
static1
Behavioral task
behavioral1
Sample
9c5bc50c9270e945600c06ca224ebb33_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9c5bc50c9270e945600c06ca224ebb33_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9c5bc50c9270e945600c06ca224ebb33_JaffaCakes118
-
Size
69KB
-
MD5
9c5bc50c9270e945600c06ca224ebb33
-
SHA1
ff4c397312bbf8e123dca0d795e31379fa7a0462
-
SHA256
3d9a3c2c4ece8181ab1837591bed5d11c8594fbd3cfd757e03003ab4bf9f86d8
-
SHA512
24e7e1633f455a2dd203841a1cd1bf2c8cb441563c48c2d60a9933c9b6e0fbe74c2c885fd6815d85a49c5f57dbf521471848ec3c1a3daa2831681e6aade6dc3f
-
SSDEEP
1536:Zvm0Vc/Y02b1fhgKYCFmhOPN8WJtWlMLFpknOvTSwId7u:ZvlO/Y02pmKZnN8qdLQnST1u7u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9c5bc50c9270e945600c06ca224ebb33_JaffaCakes118
Files
-
9c5bc50c9270e945600c06ca224ebb33_JaffaCakes118.exe windows:5 windows x86 arch:x86
51e8bba007ca2373bcccd011f0aac48b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
msvcrt
time
advapi32
RegCloseKey
netapi32
NetLocalGroupAdd
ntdll
atol
rpcrt4
RpcEpRegisterW
user32
CharUpperA
ws2_32
closesocket
ole32
CoUninitialize
vssapi
??1CVssJetWriter@@UAE@XZ
Exports
Exports
Sections
.MPRESS1 Size: 64KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE