Static task
static1
Behavioral task
behavioral1
Sample
a183d51fcce53092b3f1a89f180bdd01_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
a183d51fcce53092b3f1a89f180bdd01_JaffaCakes118
-
Size
329KB
-
MD5
a183d51fcce53092b3f1a89f180bdd01
-
SHA1
9efb919e14d115ba1783f00be809cc3dc6da5310
-
SHA256
6907d3bc37715cebb6ef38554fe9c9b86f4a6c0030b653e28eb93914583568e0
-
SHA512
c99ebb5c849a13ad8a18837993a88974033a8b4652102363f43c44a97d0dd0db8e560199ae6871fff45eff97e7bb4c2da63218caee449b28291116c0399baa93
-
SSDEEP
6144:NGhcDQ6qhY/SqY0zJZcjozIYIf4inDs61lF/NHg2:NFE/mvY0tZcjozWPnA6f7A2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource a183d51fcce53092b3f1a89f180bdd01_JaffaCakes118
Files
-
a183d51fcce53092b3f1a89f180bdd01_JaffaCakes118.exe windows:5 windows x86 arch:x86
a2fdea4c0cd5fe7bf983952b8e778a20
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
cmutil
CmMalloc
CmAtolA
CmFree
CmMoveMemory
crypt32
CertOpenSystemStoreA
CryptHashMessage
CryptDecodeMessage
CryptEncryptMessage
CryptDecryptMessage
CryptEnumOIDInfo
CryptMemRealloc
CertDeleteCTLFromStore
CertFindAttribute
CryptMsgDuplicate
advapi32
OpenEventLogW
CryptSignHashA
RegCreateKeyExA
ClearEventLogW
RegLoadKeyW
RegRestoreKeyA
ReadEventLogA
RegUnLoadKeyA
RegOpenKeyW
RegReplaceKeyA
RegEnumKeyA
RegSaveKeyA
RegDeleteValueA
IsTextUnicode
mprapi
MprInfoBlockAdd
MprAdminDeviceEnum
kernel32
RemoveDirectoryA
AddAtomW
GetProcAddress
LoadLibraryExA
OpenSemaphoreA
FindFirstFileA
CreateMutexW
GetBinaryTypeA
GetVersionExA
GetCurrentDirectoryA
GetTempFileNameW
SleepEx
FormatMessageA
lstrcatW
CreateSemaphoreA
IsBadReadPtr
LoadLibraryA
ResetEvent
HeapFree
GetConsoleAliasW
WaitForSingleObjectEx
Sections
.text Size: 317KB - Virtual size: 317KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: - Virtual size: 256B
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ