Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_43c6ba2366d0cbe931b45cd07cf0ad3a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_43c6ba2366d0cbe931b45cd07cf0ad3a.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_43c6ba2366d0cbe931b45cd07cf0ad3a
-
Size
260KB
-
MD5
43c6ba2366d0cbe931b45cd07cf0ad3a
-
SHA1
880130ac252fb5da4fd4ff44846738193dce7a38
-
SHA256
1244d23dd726639df3a0d9d32fa6b86ccd35a677f9b67185cdca663873c7f969
-
SHA512
53118df273a883b7f122bf317e19ed679fa9c4df5b8b48765c11d0a1a05ef7b50ac3c9ad67062d6d7222d1de0fec599d906f80a22b34fa47e489680c40b4394d
-
SSDEEP
6144:/APTOCuq51JsmiQFF0kJNOlsh2IiobuUnGsf8AD:/oB7BsHQz8JmG0D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_43c6ba2366d0cbe931b45cd07cf0ad3a
Files
-
JaffaCakes118_43c6ba2366d0cbe931b45cd07cf0ad3a.exe windows:4 windows x86 arch:x86
f982bf68faea31fb085b9351d99b9619
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42u
ord823
ord825
msvcrt
free
_beginthread
atl
ord21
ord18
ord22
ord15
ord16
ord44
ord43
ord32
ord58
ord23
kernel32
GetVersionExW
SetEvent
WaitForSingleObject
IsBadReadPtr
GetNumberFormatW
GetLocaleInfoW
GetCurrentProcess
InitializeCriticalSection
lstrlenW
GetModuleFileNameW
lstrcpyW
GetShortPathNameW
GetModuleHandleW
lstrcmpiW
GetWindowsDirectoryW
GlobalAlloc
GetModuleHandleA
GetLastError
LoadLibraryW
LoadLibraryA
ExpandEnvironmentStringsW
lstrcmpW
GetCurrentThread
lstrcatW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
MultiByteToWideChar
lstrlenA
LocalFree
GetProcessHeap
CreateEventW
GetProcAddress
user32
SetWindowTextW
SetFocus
SendMessageW
SetDlgItemTextW
DialogBoxParamW
SendDlgItemMessageW
wsprintfW
MessageBeep
ShowWindow
GetDlgItemInt
EndDialog
SetDlgItemInt
LoadImageW
SetCursor
LoadCursorW
ShowCursor
IsWindow
PeekMessageW
SetWindowLongW
PostMessageW
EnableWindow
GetDlgItemTextW
LoadBitmapW
IsDlgButtonChecked
LoadIconW
MessageBoxW
WinHelpW
GetSystemMetrics
advapi32
LookupPrivilegeValueW
OpenThreadToken
AdjustTokenPrivileges
ImpersonateSelf
RegOpenKeyW
RegQueryValueExW
GetUserNameW
LookupAccountNameW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
GetTokenInformation
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
oleaut32
SafeArrayGetLBound
SafeArrayGetElement
SysAllocStringByteLen
VariantChangeType
SafeArrayGetUBound
SysStringByteLen
VariantClear
VariantInit
SysStringLen
SysAllocString
SysFreeString
ole32
CoCreateInstance
CoInitialize
StringFromCLSID
gdi32
GetTextExtentPointW
DeleteObject
shell32
ShellExecuteW
shlwapi
StrFormatByteSizeW
samlib
SamCloseHandle
SamFreeMemory
SamGetGroupsForUser
SamSetMemberAttributesOfGroup
SamiSetDSRMPasswordOWF
SamCreateGroupInDomain
SamGetAliasMembership
SamEnumerateUsersInDomain
SamGetDisplayEnumerationIndex
Sections
.text Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Fq Size: 2KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SBYeOU Size: 110KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.MDnc Size: 2KB - Virtual size: 279KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.oFOQE Size: 3KB - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.QHZGU Size: 3KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kUM Size: 107KB - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ