Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0c3467ac50490f7a0bfa48a8b927d255ab81ad0a11364566f5fd678184ef44ab.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0c3467ac50490f7a0bfa48a8b927d255ab81ad0a11364566f5fd678184ef44ab.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0c3467ac50490f7a0bfa48a8b927d255ab81ad0a11364566f5fd678184ef44ab
-
Size
4.4MB
-
MD5
5aa67add712762342d5731c6a95f8014
-
SHA1
6eb2036c9f5bc1f9915eb7216526db08e487fdc4
-
SHA256
0c3467ac50490f7a0bfa48a8b927d255ab81ad0a11364566f5fd678184ef44ab
-
SHA512
ac194c0b7b1f26036f69fd90c36bae9e86b69cd68316b655782af2065cf15cf79da1b083d3178cc20c4caab1b90d67563d3a67de0cffbead1cda47e0b9446eeb
-
SSDEEP
98304:yRSlobopxXPMWdpzw1+u/TaUwuz3tH9zxQdc:yRRopxXnnxCTauzZ9Yc
Malware Config
Signatures
Files
-
JaffaCakes118_0c3467ac50490f7a0bfa48a8b927d255ab81ad0a11364566f5fd678184ef44ab.exe windows:5 windows x86 arch:x86
4c90767c35dbcc528936a0ed1ce028de
Code Sign
46:07:01:1a:c9:b0:16:e5:80:80:6c:22:72:b5:0c:d8Certificate
IssuerPOSTALCODE=10051Not Before13-09-2021 14:39Not After13-09-2022 14:39SubjectPOSTALCODE=1005179:e1:03:1c:c1:9c:5a:aa:98:ef:3e:62:c9:f8:73:e3:8e:36:db:63:45:a3:45:e8:aa:bd:c5:a1:81:54:42:a4Signer
Actual PE Digest79:e1:03:1c:c1:9c:5a:aa:98:ef:3e:62:c9:f8:73:e3:8e:36:db:63:45:a3:45:e8:aa:bd:c5:a1:81:54:42:a4Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\kagetax-sozijadexe72_vabuf7\tokuteto\hu.pdb
Imports
kernel32
GetCurrentProcess
GetEnvironmentStringsW
GetUserDefaultLCID
GetSystemDefaultLCID
ReadConsoleW
GetSystemWindowsDirectoryA
LeaveCriticalSection
FindNextVolumeW
WriteConsoleW
GetModuleFileNameW
GetACP
GetConsoleOutputCP
VerifyVersionInfoW
InterlockedExchange
GetProcAddress
EnterCriticalSection
PrepareTape
ResetEvent
LocalAlloc
GetModuleFileNameA
SetConsoleTitleW
GetModuleHandleA
AddConsoleAliasA
FindActCtxSectionStringW
GetSystemTime
GetProfileSectionW
GetLocaleInfoA
FindActCtxSectionGuid
GetCommandLineW
HeapAlloc
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapSize
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
CloseHandle
FreeEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
LoadLibraryA
CreateFileA
RaiseException
SetStdHandle
FlushFileBuffers
WriteConsoleA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile
GetProcessHeap
ReadFile
gdi32
GetCharWidthFloatA
advapi32
BackupEventLogA
Exports
Exports
@GetAnotherVice@12
Sections
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 29.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ