Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_b6c17712b0efd24ce10a4e95303ddd1d.exe
Resource
win10v2004-20250410-en
General
-
Target
JaffaCakes118_b6c17712b0efd24ce10a4e95303ddd1d
-
Size
283KB
-
MD5
b6c17712b0efd24ce10a4e95303ddd1d
-
SHA1
290072846bd5b4e77ad61b8c3ae3b4acd4120294
-
SHA256
00fdcea299be54070b9aba1eb0c90099e2c768fd5ec9f0e5d57b02281b1418eb
-
SHA512
979ebadab98a6c098ea62ad616b6879ee04cab91acecbf0f74d19777c03b57e3ce6f83ba861dcd6f686b37c0f1385803603d9b299599147d9b10da0ae5800b0a
-
SSDEEP
6144:/ggjN08z6NtTzCJjvfCiCYBnrgH1l/jdN1IBonLdcJghNCGwPvLkNj:/zjx04JjbBnEHjB82nL5hNC9wZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_b6c17712b0efd24ce10a4e95303ddd1d
Files
-
JaffaCakes118_b6c17712b0efd24ce10a4e95303ddd1d.exe windows:4 windows x86 arch:x86
d3ea18de01217179efb7ace595d45bdf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileAttributesA
InitializeCriticalSection
GetModuleFileNameA
GetModuleHandleA
FreeLibrary
GetCurrentProcessId
WaitForMultipleObjects
CreateSemaphoreA
GetSystemTime
Sleep
FileTimeToSystemTime
CreateEventA
SetEvent
OpenEventA
lstrlenA
lstrcpynA
GetShortPathNameA
LoadLibraryA
GetLastError
MultiByteToWideChar
GlobalAlloc
lstrcpyW
lstrcpyA
lstrcmpA
GetVersionExA
CreateMutexA
WaitForSingleObject
GetACP
GetLocalTime
GetTempFileNameA
SystemTimeToFileTime
OpenFile
lstrlenW
GetVersion
GetProcAddress
user32
AppendMenuA
GetDesktopWindow
CharPrevA
CharUpperA
wsprintfA
PeekMessageA
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameA
CloseServiceHandle
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegConnectRegistryA
RegQueryInfoKeyA
ole32
CoCreateInstance
mapi32
ord183
ord185
ord75
ord140
ord174
ord15
ord13
ord60
ord129
ord17
ord135
ord137
ord139
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
shfolder
SHGetFolderPathA
shell32
SHCreateDirectoryExA
msvcrt
strncpy
strstr
_mbsicmp
_mbschr
free
_mbsnbcmp
_mbscmp
_mbsdec
_mbsinc
_makepath
_mbsnbcat
fread
calloc
strncmp
_mbsnbcpy
shlwapi
PathRemoveFileSpecA
imm32
ImmGetHotKey
ImmGetOpenStatus
ImmAssociateContext
ImmGetIMEFileNameA
ImmLockIMC
ImmGetProperty
ImmSetCompositionFontA
ImmDisableIme
ImmGetVirtualKey
ImmPutImeMenuItemsIntoMappedFile
ImmIsUIMessageW
ImmSetCompositionWindow
ImmReSizeIMCC
mscat32
IsCatalogFile
CryptCATAdminAcquireContext
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.NSoBA Size: 1KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lZ Size: 1KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xX Size: 4KB - Virtual size: 369KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 90KB - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uQeU Size: 1KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nUo Size: 2KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 125KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VBUjgR Size: 2KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ