Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0647e13ee950f9ad4d2c445652e5c5d4.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0647e13ee950f9ad4d2c445652e5c5d4.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0647e13ee950f9ad4d2c445652e5c5d4
-
Size
259KB
-
MD5
0647e13ee950f9ad4d2c445652e5c5d4
-
SHA1
347829e3a6bfd9141129e5d0f53be95d4f28c81e
-
SHA256
629a55c8dfba8fc654e40ccf28893dd7129933739469b700c4ba70b1027adc9b
-
SHA512
c30543e86ce5affb1d544303e80a916a9529cee31e276939f2d7ab4ca5d3023f232eb0e06c058273c3ce3b1b76f3530df0e207e1449b35f8f05c2d6fb0721138
-
SSDEEP
6144:d7UXuxP/rOEMS4s6CqQUDdF2uLCyoUC9e2voN:tzyShqQUDdF2uaoN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_0647e13ee950f9ad4d2c445652e5c5d4
Files
-
JaffaCakes118_0647e13ee950f9ad4d2c445652e5c5d4.exe windows:4 windows x86 arch:x86
a491f8094894c41502097aa13d12344a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryW
GetTempPathW
LocalAlloc
OpenEventW
GetWindowsDirectoryW
LocalFree
lstrcpynW
WaitForSingleObject
CreateEventW
FreeLibrary
SetErrorMode
CreateDirectoryW
lstrlenW
lstrlenA
MoveFileW
CreateMutexW
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
RemoveDirectoryW
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
Beep
GetModuleHandleW
lstrcmpA
GetProcAddress
user32
GetForegroundWindow
MoveWindow
IsWindow
GetTopWindow
MessageBeep
PostMessageW
OffsetRect
RegisterWindowMessageW
InvalidateRect
DestroyIcon
SetWindowPos
SendMessageW
EnableWindow
gdi32
CreateFontIndirectW
CreateFontW
DeleteObject
CreatePatternBrush
CreateSolidBrush
advapi32
FreeSid
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExW
OpenServiceW
QueryServiceStatus
OpenSCManagerW
CloseServiceHandle
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetUserNameW
GetLengthSid
IsValidSecurityDescriptor
RevertToSelf
AddAccessAllowedAce
SetSecurityDescriptorOwner
AllocateAndInitializeSid
OpenProcessToken
OpenThreadToken
SetSecurityDescriptorGroup
AccessCheck
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ImpersonateSelf
InitializeAcl
shell32
SHGetSpecialFolderLocation
ShellExecuteW
SHBrowseForFolderW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
ole32
CoCreateInstance
usp10
UspFreeMem
ScriptStringXtoCP
ScriptGetCMap
LpkPresent
ScriptGetFontProperties
ScriptApplyDigitSubstitution
kbdur
KbdLayerDescriptor
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mEA Size: 1KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hQx Size: 3KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.GCHgo Size: 4KB - Virtual size: 338KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.y Size: 1KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.h Size: 81KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.u Size: 4KB - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.KMuDY Size: 4KB - Virtual size: 852KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.NrYxK Size: 132KB - Virtual size: 205KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ