Static task
static1
Behavioral task
behavioral1
Sample
c6pwd.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c6pwd.exe
Resource
win10v2004-20240802-en
General
-
Target
b6e3c0a780ff240d2a61c0a7d0771830_JaffaCakes118
-
Size
3KB
-
MD5
b6e3c0a780ff240d2a61c0a7d0771830
-
SHA1
2a6598f8f18ec31de5a1ec8298b82dd8eb5fa17e
-
SHA256
7d3998f2936500da6667f0b77d699d3fbcc547b44471f03e83209a3dc54f7f44
-
SHA512
6ce5dc75a03aa4d8ce33c137b95fa453758d2842b50575832c59613b22d31436aa1ead3ded16d05cd4895818ab7545ae8f920cc312c60395de8219323a195c20
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/c6pwd.exe
Files
-
b6e3c0a780ff240d2a61c0a7d0771830_JaffaCakes118.zip
-
c6pwd.c
-
c6pwd.exe.exe windows:4 windows x86 arch:x86
b9e74109057893a108c2341f5313b5d6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
ExitProcess
SetUnhandledExceptionFilter
msvcrt
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
atexit
exit
fwrite
printf
signal
sscanf
strlen
tolower
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 128B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 588B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE