Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d369430dd67df4a43c7e9320e597e2db1998c153bbaab215bf1b5f740d220e37.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d369430dd67df4a43c7e9320e597e2db1998c153bbaab215bf1b5f740d220e37.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_d369430dd67df4a43c7e9320e597e2db1998c153bbaab215bf1b5f740d220e37
-
Size
4.4MB
-
MD5
ea0722f4a734a54ed52448729cbb5c1c
-
SHA1
fdd5d2f66e4ed9f0c4bdca4f78a5c2177e15823e
-
SHA256
d369430dd67df4a43c7e9320e597e2db1998c153bbaab215bf1b5f740d220e37
-
SHA512
1d3f8224bc9c350d99fe9a4819e8c7d1f6adbb4272e58600064a990aadb7d46f747a62d1b1ed323667817a76a4b23deb6a71720cc1286260df28f4d8c71558ee
-
SSDEEP
98304:6hFDscXdfGGgdLICe7RQ+XsOw9j2dQXgQgIRMsp07mOFs:6fRfBGLHQR1s99yuXg7KMsp0qV
Malware Config
Signatures
Files
-
JaffaCakes118_d369430dd67df4a43c7e9320e597e2db1998c153bbaab215bf1b5f740d220e37.exe windows:5 windows x86 arch:x86
668261688af1c36e49fbdd48700cd1eb
Code Sign
9e:da:45:f0:84:36:19:88:bd:69:6f:ff:c1:98:72:1aCertificate
IssuerPOSTALCODE=10051Not Before15-09-2021 12:16Not After15-09-2022 12:16SubjectPOSTALCODE=1005100:f1:fd:62:67:9a:ac:0b:f2:3a:e7:98:4f:cc:86:54:3d:de:17:71:a1:fa:f5:98:e7:ac:37:d2:1a:49:45:75Signer
Actual PE Digest00:f1:fd:62:67:9a:ac:0b:f2:3a:e7:98:4f:cc:86:54:3d:de:17:71:a1:fa:f5:98:e7:ac:37:d2:1a:49:45:75Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\xeleviv-weregudo\wecutuwoza.pdb
Imports
kernel32
GetLocaleInfoA
LoadResource
ReadConsoleA
InterlockedDecrement
GetCurrentProcess
GetEnvironmentStringsW
FindActCtxSectionStringA
GetUserDefaultLangID
QueryActCtxW
InitializeCriticalSection
GetSystemWindowsDirectoryA
LeaveCriticalSection
PulseEvent
WriteConsoleW
GetModuleFileNameW
ReleaseSemaphore
GetProcAddress
DisableThreadLibraryCalls
PrepareTape
OpenMutexA
LocalAlloc
SetConsoleOutputCP
GlobalGetAtomNameW
WaitForMultipleObjects
SetSystemTime
GetModuleFileNameA
GetModuleHandleA
FindFirstVolumeA
AddConsoleAliasA
VerifyVersionInfoA
GetCommandLineW
GetLastError
HeapReAlloc
HeapAlloc
GetModuleHandleW
Sleep
ExitProcess
GetStartupInfoW
EnterCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
SetFilePointer
HeapCreate
VirtualFree
VirtualAlloc
CloseHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileA
RaiseException
SetStdHandle
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
SetEndOfFile
GetProcessHeap
MultiByteToWideChar
ReadFile
WriteConsoleA
GetConsoleOutputCP
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
user32
RealChildWindowFromPoint
Sections
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 906KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 47KB - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ