Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_fe63252acd53a420594a1feb1670dcad.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_fe63252acd53a420594a1feb1670dcad.exe
Resource
win10v2004-20250211-en
General
-
Target
JaffaCakes118_fe63252acd53a420594a1feb1670dcad
-
Size
265KB
-
MD5
fe63252acd53a420594a1feb1670dcad
-
SHA1
6284094bdfd79a323d8ef4184ce13382657aa40a
-
SHA256
563091c23ae56f28567eefd450f59bf7f672690c452a518f4882ee1c32d75271
-
SHA512
be1e3a8cdeeaaeb0a9debc254d1ea784d6b6732d9c64018be548e29934524f15f56de6a2b11a1e284e1e9bcd28e92bbaf303bf470d51ba97acde8040f0cb479f
-
SSDEEP
6144:RTbtk2RN3hSi1NW0Mr5bhisStPO1uzhFW:B5Nj3hSJ0MrFmQohFW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_fe63252acd53a420594a1feb1670dcad
Files
-
JaffaCakes118_fe63252acd53a420594a1feb1670dcad.exe windows:5 windows x86 arch:x86
49d1ec34b0941feaed60423569294bcc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoUninitialize
CoInitializeEx
OleRun
CoCreateInstance
ws2_32
closesocket
inet_addr
send
htons
ioctlsocket
connect
htonl
recv
WSACleanup
WSAStartup
ntohl
socket
kernel32
TlsGetValue
CompareStringA
CreatePipe
SetEndOfFile
SetUnhandledExceptionFilter
SetFileTime
MoveFileW
GetModuleHandleA
GetComputerNameW
IsValidLocale
SetConsoleCtrlHandler
CreateDirectoryW
GetUserDefaultLangID
FreeLibrary
FindNextFileW
VirtualFree
SetEnvironmentVariableA
GetSystemInfo
SetEnvironmentVariableW
RaiseException
CreateFileW
GetProcessTimes
FreeEnvironmentStringsW
GetFileType
GetACP
GetTimeZoneInformation
GetConsoleMode
IsDebuggerPresent
EnterCriticalSection
GetTempPathA
LCMapStringW
TlsSetValue
CopyFileW
PeekNamedPipe
GetConsoleOutputCP
GetStdHandle
GetConsoleCP
TryEnterCriticalSection
ExitThread
EnumSystemLocalesA
CreateEventW
VirtualAlloc
ResetEvent
WaitForMultipleObjects
CreateThread
ReadFile
LocalFree
CreateProcessW
CreateNamedPipeW
GetLogicalDriveStringsW
InitializeCriticalSectionAndSpinCount
TlsAlloc
WriteConsoleW
HeapSize
LocalAlloc
GetCommandLineW
ExpandEnvironmentStringsW
DisconnectNamedPipe
GetOEMCP
OpenProcess
CloseHandle
CompareStringW
UnhandledExceptionFilter
HeapFree
GetExitCodeThread
GetProcessHeap
SetLastError
LCMapStringA
TlsFree
WideCharToMultiByte
DeleteFileW
RemoveDirectoryW
FlushFileBuffers
SetFilePointer
CreateMutexW
ConnectNamedPipe
GetFileAttributesExW
FindFirstFileW
HeapReAlloc
SetFileAttributesW
DuplicateHandle
CreateFileA
SetThreadPriority
GetCurrentDirectoryW
IsValidCodePage
FindClose
OpenEventW
GetModuleHandleW
GetUserDefaultLCID
SetStdHandle
DeleteCriticalSection
HeapAlloc
WaitForSingleObject
ReleaseMutex
GetTempPathW
GetSystemTimeAsFileTime
GetCurrentThreadId
WriteConsoleA
WriteFile
RtlUnwind
SetHandleCount
LeaveCriticalSection
LoadLibraryA
VirtualAllocEx
oleaut32
SafeArrayGetLBound
VariantInit
SafeArrayDestroy
SafeArrayGetVartype
SysFreeString
SafeArrayCopy
VariantCopy
SafeArrayLock
SysAllocString
SafeArrayUnlock
VariantClear
SafeArrayGetUBound
advapi32
OpenSCManagerW
RegCreateKeyExW
RegSetValueExW
RegisterEventSourceW
SetServiceStatus
RegOpenKeyExW
SetSecurityDescriptorDacl
RegQueryValueExW
StartServiceCtrlDispatcherW
StartServiceW
RegisterServiceCtrlHandlerW
RegDeleteValueW
ChangeServiceConfigW
RegEnumKeyExW
OpenServiceA
RegQueryInfoKeyW
ReportEventW
GetSecurityDescriptorSacl
DeleteService
QueryServiceStatusEx
CloseServiceHandle
CreateServiceW
DeregisterEventSource
QueryServiceConfigW
QueryServiceStatus
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeSecurityDescriptor
RegEnumValueW
ControlService
RegDeleteKeyW
OpenServiceW
RegCloseKey
SetSecurityDescriptorSacl
ChangeServiceConfig2W
user32
MessageBoxA
winmm
timeGetTime
iphlpapi
GetAdaptersInfo
GetNetworkParams
winspool.drv
OpenPrinterA
AddJobA
AddPrinterDriverA
EnumPrinterDataW
SetDefaultPrinterW
EnumPrintProcessorDatatypesW
DEVICEMODE
GetDefaultPrinterA
FindClosePrinterChangeNotification
EnumMonitorsA
GetPrinterDriverDirectoryA
ConnectToPrinterDlg
AddPrinterConnectionW
CreatePrinterIC
EndPagePrinter
OpenPrinterW
FlushPrinter
DeviceCapabilitiesA
qcap
DllUnregisterServer
DllCanUnloadNow
DllRegisterServer
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.RENUbR Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.KNvjgW Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.kUMNCPp Size: 1024B - Virtual size: 701B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.MWxwF Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.XrUwcWU Size: 1024B - Virtual size: 569B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VTFYO Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Xach Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TAkOWAc Size: 105KB - Virtual size: 485KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 111KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.jsGaZJH Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.PxEU Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sDePOk Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE