Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0eb79fdec3961a793b895f04eec1a2d2af347203bb90bcdc27e8e01c21405ef8.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0eb79fdec3961a793b895f04eec1a2d2af347203bb90bcdc27e8e01c21405ef8.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0eb79fdec3961a793b895f04eec1a2d2af347203bb90bcdc27e8e01c21405ef8
-
Size
4.4MB
-
MD5
b96005666204d960371ae8b4d07aec2a
-
SHA1
8218741c3ca2e7f5aa03f2510ae48a9d853ff153
-
SHA256
0eb79fdec3961a793b895f04eec1a2d2af347203bb90bcdc27e8e01c21405ef8
-
SHA512
80d622ea1d45b948c0f1a096ebb81388871eeb53c136c7bca51a0766d38b072a7e3d70268edb136873dec6ac6c7b85b375747bbc3c55a8038aa82c8083dcc4fd
-
SSDEEP
98304:AzN7zsX8Vf01IR/Sm4p4/pBNiJlsxjz7F4yHoblySs:ozsMVf0+R2Wcox/7F4yGI
Malware Config
Signatures
Files
-
JaffaCakes118_0eb79fdec3961a793b895f04eec1a2d2af347203bb90bcdc27e8e01c21405ef8.exe windows:5 windows x86 arch:x86
b12e7978872b30dc79fb1024bc4610fd
Code Sign
34:b9:1d:b7:ec:e0:86:43:c5:80:0c:da:d6:50:5a:79Certificate
IssuerPOSTALCODE=10188Not Before03-09-2021 14:30Not After03-09-2022 14:30SubjectPOSTALCODE=101884b:a5:3a:22:5f:3c:9e:94:86:00:50:c0:43:87:f3:6f:8f:22:2f:fa:2d:16:e3:e3:26:f3:16:4a:46:e7:02:feSigner
Actual PE Digest4b:a5:3a:22:5f:3c:9e:94:86:00:50:c0:43:87:f3:6f:8f:22:2f:fa:2d:16:e3:e3:26:f3:16:4a:46:e7:02:feDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\xuwage\fabunibi.pdb
Imports
kernel32
SetLocalTime
GetDefaultCommConfigW
ReadConsoleA
InterlockedDecrement
GetCurrentProcess
SetEnvironmentVariableW
GetEnvironmentStringsW
GetUserDefaultLCID
AddConsoleAliasW
GetSystemDefaultLCID
EnumCalendarInfoExW
WriteFile
GetEnvironmentStrings
ReadConsoleInputA
SetVolumeMountPointA
GetSystemWindowsDirectoryA
LeaveCriticalSection
GetComputerNameExA
FindNextVolumeW
VerifyVersionInfoA
GetModuleFileNameW
GetACP
GetConsoleOutputCP
InterlockedExchange
GetProcAddress
PeekConsoleInputW
VerLanguageNameA
HeapUnlock
LocalAlloc
GetModuleFileNameA
GetModuleHandleA
QueueUserWorkItem
HeapSetInformation
GetConsoleTitleW
GlobalReAlloc
LCMapStringW
PulseEvent
CreateTimerQueue
lstrcpynW
GetCommandLineW
GetStartupInfoW
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
EnterCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
Sleep
HeapSize
ExitProcess
SetFilePointer
GetStdHandle
FreeEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetOEMCP
IsValidCodePage
MultiByteToWideChar
RtlUnwind
HeapAlloc
HeapReAlloc
VirtualAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
WriteConsoleA
WriteConsoleW
CloseHandle
CreateFileA
user32
RealGetWindowClassW
gdi32
GetCharWidthFloatA
Sections
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 29.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ