Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_640bd175e8fb9a06cde0893bc5886a20.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_640bd175e8fb9a06cde0893bc5886a20.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_640bd175e8fb9a06cde0893bc5886a20
-
Size
124KB
-
MD5
640bd175e8fb9a06cde0893bc5886a20
-
SHA1
aad46a5ef384213e8db82ccc4731cdb25affe739
-
SHA256
6bd3114e99668e4005f9eb2e905d8469ea6058350e8a395a63b965a98e135e8d
-
SHA512
99bcfb2ac88e108b001cad3e511b6c42e05296d9c0c0a4ffb1284bb666ec24598249a4a3f8b424600aa36062ba0275977b5b0aeff1c573f535a680bba94bc4e0
-
SSDEEP
3072:++u4xOzQhX9bIB3h7KYHplCcGC0VS2bYU6n4lcA:nxPrUhGEGbVWA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_640bd175e8fb9a06cde0893bc5886a20
Files
-
JaffaCakes118_640bd175e8fb9a06cde0893bc5886a20.exe windows:5 windows x86 arch:x86
9b265e2a1f9994dbaee3eb8936624db9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
ReadConsoleA
GetProcessVersion
DeleteFileA
GetPrivateProfileSectionA
TlsGetValue
GetStringTypeW
VirtualProtect
GetDriveTypeA
HeapFree
FindAtomW
GetStartupInfoA
GetLastError
GetProcessHeap
CloseHandle
lstrlenA
ReadConsoleA
SetLastError
ReadConsoleA
GetVolumePathNameW
LoadLibraryW
PulseEvent
clbcatq
ComPlusMigrate
CheckMemoryGates
CheckMemoryGates
CheckMemoryGates
DllGetClassObject
ComPlusMigrate
SetupOpen
SetupOpen
SetupOpen
CheckMemoryGates
DllGetClassObject
CheckMemoryGates
ComPlusMigrate
gpedit
DllCanUnloadNow
ExportRSoPData
DllGetClassObject
BrowseForGPO
Sections
.text Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 320B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 289B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.import Size: 512B - Virtual size: 38B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE