Static task
static1
Behavioral task
behavioral1
Sample
f6a263e61bf0785addadb29c0bef4cc8_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f6a263e61bf0785addadb29c0bef4cc8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f6a263e61bf0785addadb29c0bef4cc8_JaffaCakes118
-
Size
180KB
-
MD5
f6a263e61bf0785addadb29c0bef4cc8
-
SHA1
816e4f703b2b1d44cc1c8e1dfb6ece8982a87be0
-
SHA256
0fbdb38c2e7f1f2c77d8543fa9ef3098b8ce730f2fb23d9be30e2ece6908cc76
-
SHA512
c7a1ef74122de890ed3834fe0746a408d7782d18e0a284ab4d1ce616e816df781ee019a1b961b2849e7818289de7c8bbade86a2cb878ca0b0003f72f4b516495
-
SSDEEP
3072:YbIqxbiqZwFiC4W3RCfkFLDcVgHpDmuV2ff5DtBLmnXsQwmlwTFhY:CILqZU/3wrVgHoZxmX9wmuTTY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6a263e61bf0785addadb29c0bef4cc8_JaffaCakes118
Files
-
f6a263e61bf0785addadb29c0bef4cc8_JaffaCakes118.exe windows:4 windows x86 arch:x86
925775e3dd6148f33d982a699affcd22
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
Imports
advapi32
CryptAcquireContextW
CryptDestroyHash
CryptHashData
GetUserNameW
RegCreateKeyExA
RegDeleteValueA
RegSetValueExA
kernel32
InitializeCriticalSection
shlwapi
PathMatchSpecW
StrCmpNIA
StrCmpNIW
StrStrW
wnsprintfA
wnsprintfW
wvnsprintfA
wvnsprintfW
user32
EndDialog
ExitWindowsEx
FindWindowExA
GetMessageA
PeekMessageA
SetProcessWindowStation
Sections
.gfmzyh Size: 43KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qxat Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.loj Size: 5KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ