Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6b400072fce69ef9c602781b9bb10050.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6b400072fce69ef9c602781b9bb10050.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6b400072fce69ef9c602781b9bb10050
-
Size
124KB
-
MD5
6b400072fce69ef9c602781b9bb10050
-
SHA1
5df6313d577b44d29e1c55f108b3a843acb6d698
-
SHA256
113d4cf411afeb6a8e0ac51bab9d52382327d1e7eee8cdba3771cd3814d7d294
-
SHA512
ece57c09cfb94d43c173aa5a261f5dc6ef483d999686d9af873a369379154bf576e4b7b983355e6e81f5b46aebcbe0dfdf7dac3b6bd40ba77d89d97337635170
-
SSDEEP
3072:Aydlv7wcEUi4imSpkiFAICtuuOIIGmgN5LsV:RdBEcEZcHiFAIOaYNWV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_6b400072fce69ef9c602781b9bb10050
Files
-
JaffaCakes118_6b400072fce69ef9c602781b9bb10050.exe windows:5 windows x86 arch:x86
51989d53b67fd41d20397f72c3c80566
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
ReadConsoleA
LoadLibraryW
DeleteFileW
GetLogicalDrives
GetDriveTypeA
HeapFree
GetVolumePathNameW
GetStartupInfoA
ReadConsoleA
Sleep
ReleaseMutex
GetStringTypeW
GetLastError
PulseEvent
FindAtomW
lstrlenA
VirtualProtect
ReadConsoleA
GetPrivateProfileSectionA
CloseHandle
TlsGetValue
clbcatq
SetupOpen
DllGetClassObject
DllGetClassObject
CheckMemoryGates
CheckMemoryGates
ComPlusMigrate
CheckMemoryGates
CheckMemoryGates
ComPlusMigrate
ComPlusMigrate
SetupOpen
CheckMemoryGates
SetupOpen
gpedit
ExportRSoPData
DllCanUnloadNow
DllGetClassObject
BrowseForGPO
Sections
.text Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 320B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 289B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.import Size: 512B - Virtual size: 38B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE