Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6bf408b1119f8fbb4e0fc0e4cc329cd0.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6bf408b1119f8fbb4e0fc0e4cc329cd0.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6bf408b1119f8fbb4e0fc0e4cc329cd0
-
Size
254KB
-
MD5
6bf408b1119f8fbb4e0fc0e4cc329cd0
-
SHA1
844f5c03cfcdc4185d462e1153489aeec2b0ead8
-
SHA256
3457d653f6e17153fbd12cb2852810738e71e7bf7e50696d1bdca983c32cf61d
-
SHA512
da68990b5d04411a682e11831f3fd542cad9d978df1828ec0da5d0b01d4f3df82b0dac7236a96744e436db9e654e701aceacc7bef58888c6ec6b6cff9806806f
-
SSDEEP
6144:xlHRK6RZ/LuFzEDTMZZfIZXNjNsRJNaNWx0IKaZhWZKln10j:xlHg63/LuAMQjsNaIxNTZhCA10j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_6bf408b1119f8fbb4e0fc0e4cc329cd0
Files
-
JaffaCakes118_6bf408b1119f8fbb4e0fc0e4cc329cd0.exe windows:4 windows x86 arch:x86
50f763d828d1e1a7b372651b0f5de0b9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
netapi32
NetApiBufferFree
NetUserEnum
kernel32
lstrcmpW
CompareFileTime
lstrlenA
lstrlenW
lstrcpynW
FreeLibrary
CreateDirectoryW
LocalAlloc
RemoveDirectoryW
GetWindowsDirectoryW
LocalFree
IsDebuggerPresent
GetCurrentThreadId
WaitForSingleObject
CreateEventW
ExpandEnvironmentStringsA
OpenEventW
GetModuleHandleW
GetTempPathW
SetUnhandledExceptionFilter
GetVersion
GetProcAddress
user32
GetForegroundWindow
GetSystemMetrics
CopyRect
RegisterWindowMessageW
GetCursorPos
InvalidateRect
GetFocus
LoadCursorW
DestroyIcon
GetSysColor
MoveWindow
IsWindow
GetTopWindow
SetTimer
OffsetRect
PostMessageW
SetWindowPos
SendMessageW
EnableWindow
gdi32
CreateFontIndirectW
CreateRectRgn
CreateCompatibleDC
DeleteObject
CreatePatternBrush
CreateSolidBrush
advapi32
IsValidSecurityDescriptor
FreeSid
RegOpenKeyExA
RegQueryValueExA
OpenServiceW
StartServiceW
QueryServiceStatus
OpenSCManagerW
CloseServiceHandle
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RevertToSelf
AddAccessAllowedAce
SetSecurityDescriptorOwner
AllocateAndInitializeSid
InitializeAcl
ImpersonateSelf
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AccessCheck
SetSecurityDescriptorGroup
OpenThreadToken
OpenProcessToken
GetLengthSid
shell32
ShellExecuteW
usp10
UspFreeMem
ScriptApplyDigitSubstitution
ScriptCPtoX
ScriptJustify
icmp
IcmpCloseHandle
IcmpParseReplies
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.IjU Size: 2KB - Virtual size: 207KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.kXA Size: 2KB - Virtual size: 395KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ze Size: 2KB - Virtual size: 543KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UsAk Size: 2KB - Virtual size: 310KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CW Size: 93KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.XLbC Size: 2KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.w Size: 122KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ