Static task
static1
Behavioral task
behavioral1
Sample
60c74eef9336d446790644332f871e8b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
60c74eef9336d446790644332f871e8b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
60c74eef9336d446790644332f871e8b_JaffaCakes118
-
Size
88KB
-
MD5
60c74eef9336d446790644332f871e8b
-
SHA1
541717b10a42c296e8565300eace4deb51261e9b
-
SHA256
f71f165dabaee6de13145adaed9b4176b3afe9421f2b7c3c91f2af4ca2d3bd60
-
SHA512
612635311aa219a361994c03d9980302d2ebe277c13030908d8255f201983a065c9898aa88c0f87fd17dd2a95c00e9ff82867fb16531526e5f4854b6e29964b5
-
SSDEEP
1536:gWsroSkK3etoNEAIW8V/cYtb6hdmY0KS5bnPqYEPb3ioQWwjDPOMk3HPxxn:gZ7eKNEAI7FPUN0KS57Pyi2sC3b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60c74eef9336d446790644332f871e8b_JaffaCakes118
Files
-
60c74eef9336d446790644332f871e8b_JaffaCakes118.exe windows:5 windows x86 arch:x86
27a519f1d6b8bff6d47342695f11376b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msdart
?RemoveTail@CDoubleList@@QAEQAVCListEntry@@XZ
?IsReadLocked@CCritSec@@QBE_NXZ
?ConvertExclusiveToShared@CFakeLock@@QAEXXZ
?sm_dblDfltSpinAdjFctr@CReaderWriterLock3@@1NA
MpHeapSize
?IsReadUnlocked@CReaderWriterLock@@QBE_NXZ
?_LockSpin@CSpinLock@@AAEXXZ
?IsLocked@CLockedDoubleList@@QBE_NXZ
?SetTableLockSpinCount@CLKRLinearHashTable@@QAEXG@Z
?WriteLock@CCritSec@@QAEXXZ
?ConvertExclusiveToShared@CCritSec@@QAEXXZ
??0CReaderWriterLock3@@QAE@XZ
?TryWriteLock@CFakeLock@@QAE_NXZ
?_LockSpin@CReaderWriterLock3@@AAEXW4SPIN_TYPE@1@@Z
?GetSpinCount@CSpinLock@@QBEGXZ
MpHeapValidate
mpFree
ntdll
RtlSubtreePredecessor
NtCreateWaitablePort
sin
ZwUnloadDriver
RtlRegisterSecureMemoryCacheCallback
NlsMbCodePageTag
ZwOpenEventPair
NtSetInformationKey
RtlLockHeap
DbgPrompt
DbgUiConnectToDbg
RtlSelfRelativeToAbsoluteSD
RtlLargeIntegerArithmeticShift
ZwCreateSection
NtFilterToken
NtSystemDebugControl
NtQueryBootOptions
NtSaveMergedKeys
kernel32
GetModuleHandleW
LoadLibraryA
VirtualAlloc
InterlockedFlushSList
GetSystemTimeAsFileTime
GetCurrentThreadId
FindNextVolumeA
SetFileAttributesA
GetThreadLocale
QueryPerformanceCounter
DeactivateActCtx
VerifyConsoleIoHandle
ReplaceFileW
_lcreat
CreateMemoryResourceNotification
GetCurrentProcessId
FreeEnvironmentStringsW
OpenFile
GetProcAddress
GetTickCount
QueueUserWorkItem
SetCommConfig
GetTapeParameters
msvcrt40
iswspace
_adj_fdiv_m64
_mkdir
vsprintf
fopen
iswprint
wcscat
__CxxFrameHandler
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?eof@ios@@QBEHXZ
?unlockc@ios@@KAXXZ
system
wcstok
_spawnlp
_mbsicoll
clock
_ismbchira
?unexpected@@YAXXZ
_getmaxstdio
?sbumpc@streambuf@@QAEHXZ
rtm
RtmGetEnumDests
RtmReleaseDestInfo
RtmWriteAddressFamilyConfig
RtmGetInstances
MgmGetMfe
RtmDereferenceHandles
RtmGetListEnumRoutes
MgmGetNextMfeStats
RtmGetDestInfo
MgmDeleteGroupMembershipEntry
RtmReadInstanceConfig
RtmAddRouteToDest
RtmGetRouteAge
RtmIsRoute
advapi32
SetPrivateObjectSecurityEx
LsaRemoveAccountRights
InitiateSystemShutdownA
SaferiCompareTokenLevels
CredRenameW
CryptDestroyKey
CryptSetProvParam
SystemFunction003
LsaEnumerateAccountRights
GetEffectiveRightsFromAclA
ElfBackupEventLogFileA
CreateProcessAsUserA
AdjustTokenPrivileges
RemoveUsersFromEncryptedFile
Sections
.text Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ