Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_3c04411d35afa7a8fae8ce8e0036a3b6.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_3c04411d35afa7a8fae8ce8e0036a3b6.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_3c04411d35afa7a8fae8ce8e0036a3b6
-
Size
260KB
-
MD5
3c04411d35afa7a8fae8ce8e0036a3b6
-
SHA1
513f190181c9f37597763cdf66d55853fbd35896
-
SHA256
1ff98fcfd295c39b355a83221b522b1ae69b13cc46fea6695666663cf7b9292d
-
SHA512
499501a4b7df8fda8927bce74c91ce8fe1bc6a314e4a581e517952250748639b49d1462c54da26f301618e00e23967b20f7ba9bbd84dffb8ff7cb9c3eb875679
-
SSDEEP
6144:dAPTOCuq51JsmiQFF0kJNOlsh2IiobuUnGsf8AD:doB7BsHQz8JmG0D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_3c04411d35afa7a8fae8ce8e0036a3b6
Files
-
JaffaCakes118_3c04411d35afa7a8fae8ce8e0036a3b6.exe windows:4 windows x86 arch:x86
f982bf68faea31fb085b9351d99b9619
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42u
ord823
ord825
msvcrt
free
_beginthread
atl
ord21
ord18
ord22
ord15
ord16
ord44
ord43
ord32
ord58
ord23
kernel32
GetVersionExW
SetEvent
WaitForSingleObject
IsBadReadPtr
GetNumberFormatW
GetLocaleInfoW
GetCurrentProcess
InitializeCriticalSection
lstrlenW
GetModuleFileNameW
lstrcpyW
GetShortPathNameW
GetModuleHandleW
lstrcmpiW
GetWindowsDirectoryW
GlobalAlloc
GetModuleHandleA
GetLastError
LoadLibraryW
LoadLibraryA
ExpandEnvironmentStringsW
lstrcmpW
GetCurrentThread
lstrcatW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
MultiByteToWideChar
lstrlenA
LocalFree
GetProcessHeap
CreateEventW
GetProcAddress
user32
SetWindowTextW
SetFocus
SendMessageW
SetDlgItemTextW
DialogBoxParamW
SendDlgItemMessageW
wsprintfW
MessageBeep
ShowWindow
GetDlgItemInt
EndDialog
SetDlgItemInt
LoadImageW
SetCursor
LoadCursorW
ShowCursor
IsWindow
PeekMessageW
SetWindowLongW
PostMessageW
EnableWindow
GetDlgItemTextW
LoadBitmapW
IsDlgButtonChecked
LoadIconW
MessageBoxW
WinHelpW
GetSystemMetrics
advapi32
LookupPrivilegeValueW
OpenThreadToken
AdjustTokenPrivileges
ImpersonateSelf
RegOpenKeyW
RegQueryValueExW
GetUserNameW
LookupAccountNameW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
GetTokenInformation
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
oleaut32
SafeArrayGetLBound
SafeArrayGetElement
SysAllocStringByteLen
VariantChangeType
SafeArrayGetUBound
SysStringByteLen
VariantClear
VariantInit
SysStringLen
SysAllocString
SysFreeString
ole32
CoCreateInstance
CoInitialize
StringFromCLSID
gdi32
GetTextExtentPointW
DeleteObject
shell32
ShellExecuteW
shlwapi
StrFormatByteSizeW
samlib
SamCloseHandle
SamFreeMemory
SamGetGroupsForUser
SamSetMemberAttributesOfGroup
SamiSetDSRMPasswordOWF
SamCreateGroupInDomain
SamGetAliasMembership
SamEnumerateUsersInDomain
SamGetDisplayEnumerationIndex
Sections
.text Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Fq Size: 2KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SBYeOU Size: 110KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.MDnc Size: 2KB - Virtual size: 279KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.oFOQE Size: 3KB - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.QHZGU Size: 3KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kUM Size: 107KB - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ