Static task
static1
Behavioral task
behavioral1
Sample
f6ca00268fba9aeb911d2ff0dd3a393b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f6ca00268fba9aeb911d2ff0dd3a393b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f6ca00268fba9aeb911d2ff0dd3a393b_JaffaCakes118
-
Size
252KB
-
MD5
f6ca00268fba9aeb911d2ff0dd3a393b
-
SHA1
f1fe0c3d1b2e166f5fde8d6b93bf577360195dd4
-
SHA256
2cb5ce375ae2be9ae2cd6aec445d528b6a3126972fff4ce5df33a2a4b717fe15
-
SHA512
6ec0063635c463bed95f9cb8a74b0271b447bfe80609199176e7c26479f0773353077cf82e63327d726e154519e7e06535043ed19fd34816d22cbd386e73d064
-
SSDEEP
6144:t1rwii7st1Y+S6pYQCR+gs74dVGwG+oISthMZzLkV:tT+sH4wgsLMFkV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6ca00268fba9aeb911d2ff0dd3a393b_JaffaCakes118
Files
-
f6ca00268fba9aeb911d2ff0dd3a393b_JaffaCakes118.exe windows:4 windows x86 arch:x86
729e2b8cebe03557fa750328914aa7f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
ws2_32
WSACleanup
inet_ntoa
gethostbyname
gethostname
WSAStartup
kernel32
GetProcessHeap
RaiseException
CreateMutexW
CreateDirectoryW
RemoveDirectoryW
SetErrorMode
GetExitCodeThread
MoveFileW
GetSystemTime
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
GetSystemDirectoryW
FileTimeToSystemTime
GlobalAlloc
lstrlenW
lstrcmpiW
DosDateTimeToFileTime
ExpandEnvironmentStringsA
WaitForSingleObject
CreateEventW
LoadResource
FindResourceW
FreeLibrary
LocalFree
lstrlenA
OpenEventW
SystemTimeToFileTime
GetLocalTime
GetModuleHandleW
GetTempPathW
lstrcmpW
GetProcAddress
user32
GetForegroundWindow
MessageBoxW
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
CreateProcessAsUserW
SetSecurityInfo
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
GetSecurityInfo
DuplicateTokenEx
RegQueryValueExA
RegOpenKeyExA
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetTokenInformation
OpenProcessToken
ControlService
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW
QueryServiceConfigW
ImpersonateLoggedOnUser
RevertToSelf
SetThreadToken
LookupAccountSidW
GetUserNameW
shell32
ShellExecuteW
shlwapi
PathGetDriveNumberW
quartz
AMGetErrorTextA
DllUnregisterServer
DBToAmpFactor
AMGetErrorTextW
DllRegisterServer
AmpFactorToDB
DllCanUnloadNow
dsauth
StoreSetSearchSubTree
StoreInitHandle
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.o Size: 1KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.NCfFn Size: 5KB - Virtual size: 558KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.HFHP Size: 81KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.G Size: 1KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ReMw Size: 2KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.BmRgDG Size: 135KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ