Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d70c31c0039aa8cd96f3394529d3916d.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d70c31c0039aa8cd96f3394529d3916d.exe
Resource
win10v2004-20250207-en
General
-
Target
JaffaCakes118_d70c31c0039aa8cd96f3394529d3916d
-
Size
253KB
-
MD5
d70c31c0039aa8cd96f3394529d3916d
-
SHA1
397c21ac88b3fbdd618cb92f1a143504292826ce
-
SHA256
49d613334e779ccdd8bbdbfa1d60cbe228298db149996ba4166ec4ed694207e1
-
SHA512
bc1f236069389a3788f83ea362d1205caebbbf6c2d1697aef4792ef9ca9caf42240592830860349fe8943686ae479427ab450ce4a87f28a21568f5f07f013086
-
SSDEEP
6144:moMazGcbeLHWkd/1t8MUZ0qQgIX800Z6H3UMAj:LxzXeLHW8/1t8F0q+8vMW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_d70c31c0039aa8cd96f3394529d3916d
Files
-
JaffaCakes118_d70c31c0039aa8cd96f3394529d3916d.exe windows:4 windows x86 arch:x86
f87708d68dbfafb9e7f6cd7a710430dc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocalTime
MultiByteToWideChar
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
Sleep
lstrcmpA
GetProcAddress
LoadLibraryA
advapi32
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyW
query
CIState
LoadIFilter
DllUnregisterServer
CiSvcMain
LocateCatalogsW
BeginCacheTransaction
CITextToFullTree
mscat32
CryptCATEnumerateAttr
DllRegisterServer
CryptCATPutAttrInfo
CryptCATStoreFromHandle
CryptCATOpen
CryptCATVerifyMember
Sections
.icode Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 3KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 88KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 125KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ