Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_19079ac12cbea5b862aae66ea0e42e7c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_19079ac12cbea5b862aae66ea0e42e7c.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_19079ac12cbea5b862aae66ea0e42e7c
-
Size
252KB
-
MD5
19079ac12cbea5b862aae66ea0e42e7c
-
SHA1
d5b644b238b45e0f7f8eb2032f50596690e1c877
-
SHA256
c307e7ae59127713ef26434e754a309e3a093de61ef75fe11e0efa6fde38f812
-
SHA512
c9f8ded8a6f664ab51155cf4847f75f0e6560cc37fa280d99b9f0770d805822431e1eae4057d504ca4c04063cce59c2be058ab6b05d9a02ea79545c0e6242506
-
SSDEEP
6144:u1rwii7st1Y+S6pYQCR+gs74dVGwG+oISthMZzLkV:uT+sH4wgsLMFkV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_19079ac12cbea5b862aae66ea0e42e7c
Files
-
JaffaCakes118_19079ac12cbea5b862aae66ea0e42e7c.exe windows:4 windows x86 arch:x86
729e2b8cebe03557fa750328914aa7f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
ws2_32
WSACleanup
inet_ntoa
gethostbyname
gethostname
WSAStartup
kernel32
GetProcessHeap
RaiseException
CreateMutexW
CreateDirectoryW
RemoveDirectoryW
SetErrorMode
GetExitCodeThread
MoveFileW
GetSystemTime
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
GetSystemDirectoryW
FileTimeToSystemTime
GlobalAlloc
lstrlenW
lstrcmpiW
DosDateTimeToFileTime
ExpandEnvironmentStringsA
WaitForSingleObject
CreateEventW
LoadResource
FindResourceW
FreeLibrary
LocalFree
lstrlenA
OpenEventW
SystemTimeToFileTime
GetLocalTime
GetModuleHandleW
GetTempPathW
lstrcmpW
GetProcAddress
user32
GetForegroundWindow
MessageBoxW
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
CreateProcessAsUserW
SetSecurityInfo
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
GetSecurityInfo
DuplicateTokenEx
RegQueryValueExA
RegOpenKeyExA
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetTokenInformation
OpenProcessToken
ControlService
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW
QueryServiceConfigW
ImpersonateLoggedOnUser
RevertToSelf
SetThreadToken
LookupAccountSidW
GetUserNameW
shell32
ShellExecuteW
shlwapi
PathGetDriveNumberW
quartz
AMGetErrorTextA
DllUnregisterServer
DBToAmpFactor
AMGetErrorTextW
DllRegisterServer
AmpFactorToDB
DllCanUnloadNow
dsauth
StoreSetSearchSubTree
StoreInitHandle
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.o Size: 1KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.NCfFn Size: 5KB - Virtual size: 558KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.HFHP Size: 81KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.G Size: 1KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ReMw Size: 2KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.BmRgDG Size: 135KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ