Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_84e36a7d0ea61503541a093f200698a5.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_84e36a7d0ea61503541a093f200698a5.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_84e36a7d0ea61503541a093f200698a5
-
Size
255KB
-
MD5
84e36a7d0ea61503541a093f200698a5
-
SHA1
aa6319ab23d8ecee3fa010306a314221f55bae1a
-
SHA256
1894c41fd7a110a0945c254eb0ca5d8fa294d7a6334e98d20ba809488e688fdf
-
SHA512
c12c8d40d68206d852106bc6a9db3aed97f3ce1fea5f89b7e789e99d950a91fdd87152c591843df8a2af06f3e2c547065609d34bec9a14057d9a0afae3896570
-
SSDEEP
6144:jVUbYyT9H+OjFQZpnZl1uNOHpns7pvNuZ:j+b94OBQDSOJnsFvNu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_84e36a7d0ea61503541a093f200698a5
Files
-
JaffaCakes118_84e36a7d0ea61503541a093f200698a5.exe windows:4 windows x86 arch:x86
53c680f9cc37beba7fc8f4794b86d93f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42u
ord823
ord825
msvcrt
free
_beginthread
atl
ord21
ord18
ord22
ord15
ord16
ord44
ord43
ord32
ord58
ord23
kernel32
GetVersionExW
SetEvent
WaitForSingleObject
IsBadReadPtr
GetNumberFormatW
GetLocaleInfoW
GetCurrentProcess
InitializeCriticalSection
lstrlenW
GetModuleFileNameW
lstrcpyW
GetShortPathNameW
GetModuleHandleW
lstrcmpiW
GetWindowsDirectoryW
GlobalAlloc
GetModuleHandleA
GetLastError
LoadLibraryW
LoadLibraryA
ExpandEnvironmentStringsW
lstrcmpW
GetCurrentThread
lstrcatW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
MultiByteToWideChar
lstrlenA
LocalFree
GetProcessHeap
CreateEventW
lstrcmpA
GetProcAddress
user32
SetWindowTextW
SetFocus
SendMessageW
SetDlgItemTextW
DialogBoxParamW
SendDlgItemMessageW
wsprintfW
MessageBeep
ShowWindow
GetDlgItemInt
EndDialog
SetDlgItemInt
LoadImageW
SetCursor
LoadCursorW
ShowCursor
IsWindow
PeekMessageW
SetWindowLongW
PostMessageW
EnableWindow
GetDlgItemTextW
LoadBitmapW
IsDlgButtonChecked
LoadIconW
MessageBoxW
WinHelpW
GetSystemMetrics
advapi32
LookupPrivilegeValueW
OpenThreadToken
AdjustTokenPrivileges
ImpersonateSelf
RegOpenKeyW
RegQueryValueExW
GetUserNameW
LookupAccountNameW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
GetTokenInformation
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
oleaut32
SafeArrayGetLBound
SafeArrayGetElement
SysAllocStringByteLen
VariantChangeType
SafeArrayGetUBound
SysStringByteLen
VariantClear
VariantInit
SysStringLen
SysAllocString
SysFreeString
ole32
CoCreateInstance
CoInitialize
StringFromCLSID
gdi32
GetTextExtentPointW
DeleteObject
shell32
ShellExecuteW
shlwapi
StrFormatByteSizeW
samlib
SamCloseHandle
SamFreeMemory
SamQueryDisplayInformation
SamRemoveMemberFromAlias
SamQueryInformationGroup
SamRemoveMemberFromGroup
SamConnect
SamEnumerateGroupsInDomain
SamLookupNamesInDomain
Sections
.text Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xlGmKg Size: 106KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Zn Size: 3KB - Virtual size: 218KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 4KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qUAmPP Size: 109KB - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.LaBLsx Size: 2KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ