Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331
-
Size
206KB
-
MD5
6c45614f4b86ac9b6e6c2c177f090331
-
SHA1
bcd6c0dda5b70c0abde14f4a01139c7630ed7afb
-
SHA256
f339277fb4e1f35040584eb20143a7bf3fdb1f685703d5b0ffe4d2372c047af4
-
SHA512
e26e69a8490c48534121a4aa5caa29647ccf1ce893b5327268e2b27df8e760973271ceb83b30eb0131cea3872626450c5ebdc825d08861a4eb0fcf8acb532ae2
-
SSDEEP
3072:lNe1hc7vtDx/AvKTn5hZ5q35IDIQ8MBYh4EC/gDTvmHNbZLHwM+ET+vG3vTK:Xe1KFDxDTn5hZQ3sMv/mBRwMnBL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331
Files
-
JaffaCakes118_6c45614f4b86ac9b6e6c2c177f090331.exe windows:4 windows x86 arch:x86
8b46375fa1e6c56675e3cc4330b9a97d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
user32
RealGetWindowClass
LoadImageW
IsZoomed
IsWindow
SetWindowPlacement
LoadIconW
GetParent
SetWindowPos
IsIconic
MapVirtualKeyW
DestroyWindow
GetWindowPlacement
ShowWindow
GetSystemMetrics
UpdateWindow
SetForegroundWindow
setupapi
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status
kernel32
WaitForSingleObject
CreateFiberEx
GetSystemTimeAsFileTime
GetLocaleInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetModuleHandleW
CloseHandle
LoadLibraryW
TlsFree
ReleaseSemaphore
GetTickCount
TerminateProcess
GetProcAddress
GetCurrentProcess
DeleteFileW
GetProcessHeap
EnumResourceNamesA
LoadLibraryA
InterlockedExchange
FoldStringW
RaiseException
InterlockedCompareExchange
GetLastError
FlushFileBuffers
QueryPerformanceCounter
CreateSemaphoreW
LocalAlloc
GetCurrentProcessId
TlsGetValue
FreeLibrary
IsDebuggerPresent
GetCurrentThreadId
TlsAlloc
VirtualProtect
GetStartupInfoA
GetCommandLineW
Sleep
GetModuleFileNameW
msimg32
AlphaBlend
Sections
.text Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ