Static task
static1
Behavioral task
behavioral1
Sample
f8010f39a6b49af2753a6366ad86039e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f8010f39a6b49af2753a6366ad86039e_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f8010f39a6b49af2753a6366ad86039e_JaffaCakes118
-
Size
147KB
-
MD5
f8010f39a6b49af2753a6366ad86039e
-
SHA1
de121d48141311d1c49b23fea73c7d7b0d2712e5
-
SHA256
986b85010391746a6444e9cddff352be59660560384ea01a8e506d8339bf4ae5
-
SHA512
2a561b5f0121128fb941acf7eb1b05cb5d2944f149382c1bab8e0a1e53adaa6119a90de437f96994a8184d1512254c2d151fdb0a62178aa3bdb469bc9630e36c
-
SSDEEP
3072:SRyhSeoAwzznccBRJ9Ne1vEru/QOP8eAnRTxOcXupjaR8:SRyhQAwzjv7J9Ai6FEOc+daR8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8010f39a6b49af2753a6366ad86039e_JaffaCakes118
Files
-
f8010f39a6b49af2753a6366ad86039e_JaffaCakes118.exe windows:2 windows x86 arch:x86
1ee73fe1e3f52517989de00ef14c58b2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetFileSecurityW
RegQueryValueExW
OpenProcessToken
OpenThreadToken
DestroyPrivateObjectSecurity
GetSecurityDescriptorSacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CreatePrivateObjectSecurityEx
GetSecurityDescriptorDacl
RegDeleteValueW
RegOpenKeyExA
RegCreateKeyExW
kernel32
ExpandEnvironmentStringsW
GetWindowsDirectoryW
FreeLibrary
GetCurrentThread
GetDateFormatA
GetTimeFormatA
InterlockedDecrement
InterlockedIncrement
FlushFileBuffers
GetFileSize
SetEndOfFile
UnlockFileEx
LockFileEx
SetFilePointer
ReadFile
GetSystemTime
SystemTimeToFileTime
CopyFileW
CreateFileW
GetFileAttributesW
SetFileAttributesW
LocalFree
RemoveDirectoryW
FindNextFileW
FindFirstFileW
CreateDirectoryW
UnmapViewOfFile
LocalAlloc
MapViewOfFile
GetTickCount
GetModuleHandleW
CloseHandle
SetLastError
GetVersion
InitializeCriticalSectionAndSpinCount
VirtualFree
ExitProcess
DeleteFileW
HeapAlloc
GetProcessHeap
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetLastError
GetVersionExA
GetVersionExW
InterlockedExchange
Sleep
InterlockedCompareExchange
OutputDebugStringA
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileMappingW
VirtualAllocEx
FindFirstFileA
msvcrt
fprintf
fflush
fclose
fread
_wfopen
_errno
_purecall
iswctype
_onexit
_lock
__dllonexit
_unlock
_controlfp
memmove
memcpy
memset
__set_app_type
__setusermatherr
_amsg_exit
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs
ole32
StringFromIID
CoInitialize
CoCreateInstance
StgOpenStorage
StgOpenStorageEx
PropVariantClear
CoTaskMemFree
CoUninitialize
oleaut32
SysStringLen
SysAllocStringLen
SysAllocStringByteLen
SysAllocString
SysFreeString
SysStringByteLen
ntdll
wcsrchr
_wcsnicmp
_ltow
_vsnprintf
towlower
atol
_vsnwprintf
wcsncmp
RtlUnwind
_wcsicmp
rpcrt4
UuidCreate
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
mscat32
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
user32
IsCharLowerW
msi
MsiSourceListAddSourceW
MsiGetTargetPathA
MsiGetProductInfoFromScriptA
MsiEnumProductsExW
MsiEnumProductsExA
MsiApplyMultiplePatchesW
MsiSetTargetPathA
MsiSourceListClearSourceW
MsiDatabaseOpenViewW
MsiEnumProductsA
MsiSummaryInfoPersist
MsiDatabaseGetPrimaryKeysW
MsiSourceListClearAllW
MsiOpenPackageA
MsiConfigureFeatureW
MsiSourceListForceResolutionW
MsiSetInternalUI
MsiDatabaseExportW
MsiQueryFeatureStateA
MsiGetProductCodeFromPackageCodeW
MsiRecordSetStreamW
MsiNotifySidChangeA
MsiSourceListAddSourceExA
MsiPreviewDialogA
MsiEnableUIPreview
MsiUseFeatureExW
MsiPreviewBillboardA
MsiSourceListAddMediaDiskW
MsiDatabaseIsTablePersistentW
MsiDatabaseCommit
MsiViewModify
MsiSetMode
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 113KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ