Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6963d7d46b1e56096f4631214f15de80.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6963d7d46b1e56096f4631214f15de80.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6963d7d46b1e56096f4631214f15de80
-
Size
135KB
-
MD5
6963d7d46b1e56096f4631214f15de80
-
SHA1
3fac3e6fe95b25410424314f613d0a328a69dc4b
-
SHA256
1c16b020f4ee14a6c53c5218ae70611b62a5dd6182ebd82e46c3220ef970eb81
-
SHA512
bbf87f30717213466c29cd29b2a345dd9b2ff97b7ceca8b6c6fb5a760d5d3feee2e389dc7f09a32ab25301f80beb024fe8e80fe2d7dd0b050c7351b8174c818c
-
SSDEEP
1536:PRQD9sHrIcdEg6lU4h3ObJe6F6UTEFic/cr92kuGbEib65/IzDMOSLv4F8v3nn+f:PNa+86CsB5bhmlIzDSnvny/X4c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_6963d7d46b1e56096f4631214f15de80
Files
-
JaffaCakes118_6963d7d46b1e56096f4631214f15de80.exe windows:5 windows x86 arch:x86
0b3c067711c14937c5872bb8e178b171
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
DeleteFileA
GetProcessHeap
ReadConsoleA
SetLastError
CloseHandle
ReadConsoleA
GetPrivateProfileSectionA
TlsGetValue
GetStringTypeW
GetLastError
GetDriveTypeA
FindAtomW
HeapFree
GetProcessVersion
ReadConsoleA
GetStartupInfoA
GetVolumePathNameW
VirtualProtect
LoadLibraryW
PulseEvent
lstrlenA
clbcatq
CheckMemoryGates
SetupOpen
SetupOpen
CheckMemoryGates
SetupOpen
CheckMemoryGates
ComPlusMigrate
DllGetClassObject
DllGetClassObject
ComPlusMigrate
CheckMemoryGates
ComPlusMigrate
CheckMemoryGates
gpedit
ExportRSoPData
DllCanUnloadNow
BrowseForGPO
DllGetClassObject
Sections
.text Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 320B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 289B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.import Size: 512B - Virtual size: 38B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE