Static task
static1
Behavioral task
behavioral1
Sample
6ab7952fc709a1a607f6175b8cebb086_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6ab7952fc709a1a607f6175b8cebb086_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6ab7952fc709a1a607f6175b8cebb086_JaffaCakes118
-
Size
277KB
-
MD5
6ab7952fc709a1a607f6175b8cebb086
-
SHA1
2cadc100a1a078199530ed53e6b09562dff7c2ca
-
SHA256
2f057133b7cab647bed67f0f20f4049cd980a3f14af3fddc68c82b2b58984428
-
SHA512
aef9e581ab8d981291ed897ee0d6426b494e517bab8a9f2b6c6863d27dfc3c317f5a3578d5f06e914afc9da69a0c7bce20e1d60e2663f20f4c852b5236fc3260
-
SSDEEP
6144:iV1VjlMindSC/xSAZ21ICSFjmf9fWDCxS2K0naW+tIqlnlkka:i1jlMiSGxBUVSFmf9fx2G4eu6r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6ab7952fc709a1a607f6175b8cebb086_JaffaCakes118
Files
-
6ab7952fc709a1a607f6175b8cebb086_JaffaCakes118.exe windows:4 windows x86 arch:x86
330f2c5dace9c3041f0ad21343d6373a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWindowsDirectoryA
lstrcpyA
ExpandEnvironmentStringsA
lstrcpyW
ExpandEnvironmentStringsW
GetCurrentThreadId
GetSystemInfo
GetModuleHandleW
GetTempPathA
GetTempFileNameA
SetErrorMode
OpenEventA
OpenMutexA
OpenSemaphoreA
CreateEventA
GetSystemDirectoryA
CreateSemaphoreA
SleepEx
QueryPerformanceFrequency
SetUnhandledExceptionFilter
CreateSemaphoreW
WaitForSingleObject
GetModuleHandleA
FreeLibrary
GetProcessHeap
CreateMutexA
IsDebuggerPresent
GetStartupInfoW
GetProcAddress
user32
GetSystemMetrics
wsprintfA
CharUpperA
CharLowerA
CharUpperW
CharLowerW
advapi32
DuplicateTokenEx
GetUserNameA
LookupAccountSidA
LookupPrivilegeValueA
AdjustTokenPrivileges
GetTokenInformation
EqualSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
AllocateAndInitializeSid
GetLengthSid
FreeSid
CopySid
OpenThreadToken
ImpersonateLoggedOnUser
OpenProcessToken
DuplicateToken
SetThreadToken
RevertToSelf
shlwapi
PathUnExpandEnvStringsW
PathUnExpandEnvStringsA
rtutils
RouterLogRegisterW
RouterLogEventW
RouterLogDeregisterW
TraceVprintfExW
LogEventW
iyuv_32
DllMain
AboutDialogProc
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ui Size: 4KB - Virtual size: 539KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TRYlp Size: 99KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.DZ Size: 1KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qsdP Size: 1024B - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.GRSLe Size: 115KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.FmqEgM Size: 3KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ