Static task
static1
Behavioral task
behavioral1
Sample
0c61fb41aa98f77130e75a9bdfc8d80e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0c61fb41aa98f77130e75a9bdfc8d80e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0c61fb41aa98f77130e75a9bdfc8d80e_JaffaCakes118
-
Size
45KB
-
MD5
0c61fb41aa98f77130e75a9bdfc8d80e
-
SHA1
2303df6cac89b79a49f025e3061cd4ca8c5717c9
-
SHA256
66248bca7781a7f1d9e71aadba6c6d5a208810333f794e8579f1045a142d9868
-
SHA512
4b87b3b49f5dd130ff2233edea4d6f2126bf03ab233afa7386c2449b7c833a019e2c1563998bb37ea8edf72e960bc6bb1d3babb04e968dd3f87cfe8117ffda1f
-
SSDEEP
768:rKgGXefEhguK0iMG45iVDCuorZv1LWAPizQy0WljCljBe6/DQlr4TsY:+gJfsg30XB5iDCuW1LWAPi1rj8jUMQ9O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c61fb41aa98f77130e75a9bdfc8d80e_JaffaCakes118
Files
-
0c61fb41aa98f77130e75a9bdfc8d80e_JaffaCakes118.exe windows:5 windows x86 arch:x86
1d3b508a0a3c1db621a13364146d2a4f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlDestroyQueryDebugBuffer
ZwQueryInformationFile
ZwCreateFile
ZwWriteFile
strlen
swprintf
wcsrchr
_wcsicmp
ZwFsControlFile
ZwCreateSection
ZwMapViewOfSection
ZwImpersonateThread
ZwFlushVirtualMemory
ZwUnmapViewOfSection
ZwCreateSymbolicLinkObject
ZwLoadDriver
ZwSetSecurityObject
ZwReadFile
RtlRandom
strrchr
LdrFindResource_U
LdrAccessResource
ZwSetEvent
RtlEqualUnicodeString
ZwCreateEvent
ZwOpenThread
ZwOpenProcess
ZwQuerySystemInformation
LdrFindEntryForAddress
RtlNtStatusToDosError
memset
wcslen
ZwSetValueKey
ZwCreateKey
wcstoul
RtlInitUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
ZwQueryKey
RtlComputeCrc32
sprintf
RtlIpv4AddressToStringA
ZwClose
ZwOpenKey
ZwQueryValueKey
ZwSuspendThread
ZwQueryInformationThread
_stricmp
ZwResumeThread
ZwSetContextThread
ZwWriteVirtualMemory
ZwSetInformationFile
ZwDelayExecution
ZwWaitForSingleObject
ZwGetContextThread
RtlExitUserThread
RtlCreateUserThread
ZwDuplicateObject
RtlDosPathNameToNtPathName_U
ZwOpenFile
ZwQueryInformationProcess
RtlAdjustPrivilege
RtlImageNtHeader
memcpy
_allshr
kernel32
LoadLibraryW
ExitProcess
GetTickCount
FreeLibrary
GetProcAddress
GetVersion
GetModuleHandleW
HeapFree
GetProcessHeap
HeapAlloc
GetSystemTimeAsFileTime
GetLastError
BindIoCompletionCallback
GetSystemDefaultLangID
advapi32
MD5Final
MD5Update
MD5Init
ws2_32
WSAStartup
WSASend
WSARecv
WSAIoctl
bind
closesocket
WSAGetLastError
WSASocketW
WSACleanup
rpcrt4
UuidCreateSequential
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ