Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_c867f6f8e99afa505d84bf094d9d91d0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_c867f6f8e99afa505d84bf094d9d91d0.exe
Resource
win10v2004-20250207-en
General
-
Target
JaffaCakes118_c867f6f8e99afa505d84bf094d9d91d0
-
Size
351KB
-
MD5
c867f6f8e99afa505d84bf094d9d91d0
-
SHA1
96ba1b830d01b1b427af336addd9ecd309970f48
-
SHA256
661fb6187cd6272ac1441a0a290d04e6aa82723c088e31ae6bd027d6d8cf35c7
-
SHA512
15c91a219f9a3e8c7fd028f34a431a294cdda638e889cc81e8d335fb6a329662a38a99bb65047783db70aaedc95bf8f59698a76fe77bf7be2cf607ec8cadadfd
-
SSDEEP
6144:jjIsEKnUD+UpaXJ2RzsK2kZkhNc+TyghdQBVi4QbDqQP:v7ExDXAwLZmugYi4Qb+QP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_c867f6f8e99afa505d84bf094d9d91d0
Files
-
JaffaCakes118_c867f6f8e99afa505d84bf094d9d91d0.exe windows:5 windows x86 arch:x86
6574053f4d982ff70d3332cdb9dc3583
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
RpcServerListen
RpcServerRegisterIf
RpcServerRegisterAuthInfoA
RpcServerUseProtseqEpA
RpcServerUnregisterIf
RpcMgmtStopServerListening
NdrServerCall2
kernel32
DeleteFileW
GetLocalTime
PostQueuedCompletionStatus
IsDebuggerPresent
GetPriorityClass
UnlockFile
LocalFree
CompareStringW
GetFileSize
GetTempFileNameW
CreateProcessW
FreeLibrary
ReleaseMutex
QueueUserWorkItem
EnumSystemLocalesA
HeapFree
ReleaseSemaphore
LCMapStringW
CreateFileMappingA
SetFilePointer
WideCharToMultiByte
CreateFileW
CreateTimerQueue
GetACP
GetSystemTime
CreateMutexW
GetShortPathNameA
GetComputerNameW
FreeEnvironmentStringsW
QueryPerformanceFrequency
GetCommandLineA
SetThreadPriority
GetProcessHeap
GlobalMemoryStatusEx
GetUserDefaultLCID
GetVolumePathNamesForVolumeNameW
TlsFree
HeapReAlloc
SetStdHandle
MoveFileW
GetSystemTimeAsFileTime
SetHandleCount
HeapDestroy
GetDriveTypeW
TlsSetValue
CreateDirectoryW
GetOEMCP
GetVolumeInformationW
CreateFileMappingW
GetFileSizeEx
GetQueuedCompletionStatus
SetUnhandledExceptionFilter
UnmapViewOfFile
WriteConsoleA
CopyFileW
CreateTimerQueueTimer
TlsAlloc
RaiseException
GetModuleHandleA
GetSystemInfo
IsValidCodePage
SetFilePointerEx
VirtualFree
LoadLibraryExA
UnregisterWait
CreateSemaphoreW
DeleteTimerQueueEx
CreateThread
OpenProcess
SetErrorMode
ResetEvent
EnterCriticalSection
UnhandledExceptionFilter
CloseHandle
DeleteCriticalSection
LCMapStringA
FlushFileBuffers
TlsGetValue
IsValidLocale
CreateEventW
UnregisterWaitEx
VirtualAlloc
OpenEventA
WaitForSingleObject
SystemTimeToFileTime
HeapSize
SetPriorityClass
GetConsoleMode
GetConsoleOutputCP
WriteFile
SetEndOfFile
FreeEnvironmentStringsA
GetThreadPriority
ExpandEnvironmentStringsW
LockFileEx
DeleteTimerQueueTimer
CreateMutexA
OpenMutexA
GetFileType
CreateIoCompletionPort
CreateEventA
WriteConsoleW
LeaveCriticalSection
RegisterWaitForSingleObject
HeapAlloc
GetStdHandle
SetLastError
GlobalFree
GetComputerNameA
GetCurrentThreadId
GlobalAlloc
RtlUnwind
CompareStringA
GetConsoleCP
ReadFile
WaitForMultipleObjects
MapViewOfFile
CreateFileA
LoadLibraryW
VirtualAllocEx
user32
CharNextExA
CharUpperBuffW
CharPrevExA
wsprintfA
advapi32
GetTokenInformation
InitializeAcl
DuplicateTokenEx
FreeSid
GetTraceEnableFlags
SetServiceStatus
GetTraceEnableLevel
ReportEventW
GetLengthSid
LookupAccountSidA
RegCloseKey
RegisterTraceGuidsA
AddAccessAllowedAce
SetSecurityDescriptorDacl
CloseServiceHandle
RegOpenKeyExW
OpenSCManagerW
DuplicateToken
InitializeSecurityDescriptor
UnregisterTraceGuids
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenServiceW
DeregisterEventSource
AllocateAndInitializeSid
RegCreateKeyExW
StartServiceCtrlDispatcherW
GetTraceLoggerHandle
RegSetValueExW
RegisterEventSourceW
AddAccessDeniedAce
RegQueryValueExW
SetThreadToken
RegisterServiceCtrlHandlerExW
TraceMessage
ConvertStringSecurityDescriptorToSecurityDescriptorA
atmlib
ATMFinish
ATMGetNtmFields
ATMBBoxBaseXYShowTextA
ATMBeginFontChange
ATMFontSelected
ATMGetGlyphListA
ATMRemoveSubstFontW
ATMEnumFontsW
kbdic
KbdLayerDescriptor
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 324KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ