Static task
static1
Behavioral task
behavioral1
Sample
38571e643b9f58a20170454558f61859_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
38571e643b9f58a20170454558f61859_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
38571e643b9f58a20170454558f61859_JaffaCakes118
-
Size
253KB
-
MD5
38571e643b9f58a20170454558f61859
-
SHA1
cec3f6d1139e3dba17d6f33e2a4bee28a1e8c79f
-
SHA256
0c4ca3194b8cc185a7caf7f74491237b198e1c3a85a98e85d8681dc75f602ac2
-
SHA512
33c679a344070a8c7ab8bbd2ae39043719b6ba0465f603828ec13caa2c067da452276043e1291ec42c5a526aef462a2ff8af30d6e67803bcffdb14800887b5c6
-
SSDEEP
6144:RoMazGcbeLHWkd/1t8MUZ0qQgIX800Z6H3UMAj:CxzXeLHW8/1t8F0q+8vMW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38571e643b9f58a20170454558f61859_JaffaCakes118
Files
-
38571e643b9f58a20170454558f61859_JaffaCakes118.exe windows:4 windows x86 arch:x86
f87708d68dbfafb9e7f6cd7a710430dc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocalTime
MultiByteToWideChar
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
Sleep
lstrcmpA
GetProcAddress
LoadLibraryA
advapi32
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyW
query
CIState
LoadIFilter
DllUnregisterServer
CiSvcMain
LocateCatalogsW
BeginCacheTransaction
CITextToFullTree
mscat32
CryptCATEnumerateAttr
DllRegisterServer
CryptCATPutAttrInfo
CryptCATStoreFromHandle
CryptCATOpen
CryptCATVerifyMember
Sections
.icode Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 3KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 88KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 125KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ