Static task
static1
Behavioral task
behavioral1
Sample
6bde0cd0c88892285dc43139f1947cf7_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6bde0cd0c88892285dc43139f1947cf7_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
6bde0cd0c88892285dc43139f1947cf7_JaffaCakes118
-
Size
100KB
-
MD5
6bde0cd0c88892285dc43139f1947cf7
-
SHA1
1426366c89706e65cffbc341ecafa78767e8cf32
-
SHA256
b5962b1baf2d66ae41bcc79451c99c7ceb26fdbd3ab3cef801195eecd47b0b1b
-
SHA512
88a920706839f9c5a0ab7c54ad51cd705d387a5d5c518b171d99b164b9626f97f9b6237419037593bd990687676baa18f09d7e9f73d40f9f333ecea42d95ace1
-
SSDEEP
1536:+v1+XaxZm3NMyDWHUPCc1/G7FeJZ4FP0jerXXQWqbXVXTrtU7ZK+G2N3s2AOsR7r:vqfxyiTs2FeJC90jEVqrR2ZN3EO8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6bde0cd0c88892285dc43139f1947cf7_JaffaCakes118
Files
-
6bde0cd0c88892285dc43139f1947cf7_JaffaCakes118.exe windows:5 windows x86 arch:x86
844d234f11382cf3517e7fc2c7c8ea60
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
certcli
CACertTypeGetSecurity
CASetCertTypeExtension
CACloseCertType
CASetCertTypeKeySpec
CAEnumNextCertType
CAFindByName
CAFreeCertTypeProperty
CAFindCertTypeByName
CARemoveCACertificateType
CAUpdateCertType
CAFreeCAProperty
CAAddCACertificateType
CAGetCertTypeFlags
CAGetCertTypeExtensions
CAGetCAProperty
CACloseCA
CASetCertTypeFlags
CAGetCertTypeKeySpec
CAEnumCertTypesForCA
CACertTypeSetSecurity
CAGetCertTypeProperty
CAUpdateCA
CACreateCertType
CAEnumCertTypes
CASetCertTypeProperty
CAGetCertTypePropertyEx
CAFreeCertTypeExtensions
kernel32
IsBadReadPtr
InitializeCriticalSection
GetCPInfo
GetSystemTimeAsFileTime
LocalReAlloc
lstrcpyW
InterlockedDecrement
SetLastError
FormatMessageW
GetSystemDefaultLangID
SetUnhandledExceptionFilter
GetProcAddress
CloseHandle
GetLastError
InterlockedIncrement
OutputDebugStringA
GetModuleHandleA
LocalFree
QueryPerformanceCounter
WideCharToMultiByte
GlobalUnlock
FileTimeToLocalFileTime
GetModuleFileNameW
LoadLibraryW
GetStartupInfoA
OutputDebugStringW
GetEnvironmentStringsW
FileTimeToSystemTime
GlobalFree
GetDateFormatW
GetSystemWindowsDirectoryW
lstrcmpiW
GetComputerNameW
lstrlenW
RemoveDirectoryA
DeleteCriticalSection
CreateFileW
GetCurrentProcess
GetTickCount
GlobalLock
GlobalAlloc
advapi32
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
user32
GetParent
SetCursor
SetFocus
wsprintfW
LoadBitmapW
EndDialog
SetWindowTextW
InsertMenuItemW
LoadIconW
SetDlgItemTextW
LoadCursorW
SetWindowLongW
MessageBoxW
EnableWindow
SendMessageW
LoadStringW
ReleaseDC
GetDC
SendDlgItemMessageW
LoadImageW
GetWindowLongW
WinHelpW
GetDlgItem
DialogBoxParamW
PostMessageW
GetDlgItemTextA
RegisterClipboardFormatW
SystemParametersInfoW
msvcrt
wcscmp
wcsrchr
??2@YAPAXI@Z
wcsstr
__RTDynamicCast
_except_handler3
_adjust_fdiv
wcscat
??3@YAXPAX@Z
memmove
_initterm
_wcsupr
wcslen
malloc
free
_onexit
mbstowcs
__dllonexit
??1type_info@@UAE@XZ
vswprintf
_wcsicmp
wcstoul
wcscpy
wcschr
?terminate@@YAXXZ
comctl32
CreatePropertySheetPageW
PropertySheetW
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ