Static task
static1
Behavioral task
behavioral1
Sample
fa9c65b956d914ad371b78d6248c0b07_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fa9c65b956d914ad371b78d6248c0b07_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fa9c65b956d914ad371b78d6248c0b07_JaffaCakes118
-
Size
154KB
-
MD5
fa9c65b956d914ad371b78d6248c0b07
-
SHA1
b9c7d6bde6de3ff6d41da62eb7165fc549bea7ad
-
SHA256
53b5dc643180365e8ee371c131d5c2e828b0b5f63062bbfb3ff9525f982b1b53
-
SHA512
0c1d65381a76e0db0b6a720cb2460598f7ae982b935609f3c104d6a0aa9068c100478ce25260633fcd9699bb45127bc2b41e5be212f80d1baca51f52b7cb9e49
-
SSDEEP
3072:qRisjqGJVfi5fPZBm+Q4LZhyppOaF1NnzM88AP4ANwstdW:qRifGJVfi55dQ4Xypp1gF9ANttdW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa9c65b956d914ad371b78d6248c0b07_JaffaCakes118
Files
-
fa9c65b956d914ad371b78d6248c0b07_JaffaCakes118.exe windows:5 windows x86 arch:x86
d9b26a4b8b52dfb95f5c677f3649542c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GdiDeleteSpoolFileHandle
GetRegionData
EnumFontFamiliesExW
FloodFill
SetMiterLimit
DdEntry5
DeleteColorSpace
EngMultiByteToUnicodeN
PATHOBJ_vGetBounds
GdiCleanCacheDC
PolyBezier
DdEntry10
PolylineTo
GdiConvertAndCheckDC
XFORMOBJ_bApplyXform
GdiSetServerAttr
GetDCBrushColor
CreateBitmapIndirect
GetDeviceCaps
StartDocA
GetDCPenColor
XLATEOBJ_cGetPalette
CreateEnhMetaFileA
GdiIsMetaFileDC
GetPixel
GdiInitSpool
EngPlgBlt
GdiPlayJournal
GetPaletteEntries
GetCurrentPositionEx
GetCharABCWidthsA
GetFontAssocStatus
GetBrushOrgEx
CloseFigure
EngGetDriverName
AddFontResourceExA
EudcLoadLinkW
GdiStartPageEMF
BRUSHOBJ_pvGetRbrush
GdiPlayDCScript
ntdll
NtCreateSemaphore
RtlCompareUnicodeString
RtlLargeIntegerSubtract
ZwOpenJobObject
ZwUnloadKey
RtlpUnWaitCriticalSection
RtlExtendedIntegerMultiply
fabs
ZwSetSecurityObject
RtlUnlockBootStatusData
NtStopProfile
RtlFindMessage
RtlUnicodeStringToCountedOemString
NtRenameKey
_strcmpi
_allrem
ZwReadFileScatter
RtlLengthSid
NtOpenFile
ZwAccessCheckByTypeResultList
NtSetLowWaitHighEventPair
NtRaiseHardError
RtlpNtMakeTemporaryKey
RtlMakeSelfRelativeSD
RtlUnicodeStringToInteger
RtlUpcaseUnicodeToMultiByteN
NtAccessCheckByType
NtResetWriteWatch
RtlCopyString
ZwReleaseSemaphore
RtlFlushSecureMemoryCache
ZwImpersonateThread
RtlGetSecurityDescriptorRMControl
NtQuerySystemEnvironmentValue
RtlDllShutdownInProgress
NtCreateSymbolicLinkObject
NtOpenObjectAuditAlarm
NtSetInformationFile
ZwSetSystemInformation
RtlValidateUnicodeString
ZwAcceptConnectPort
RtlEqualUnicodeString
ZwLockProductActivationKeys
RtlAreBitsSet
ZwRequestPort
RtlDosApplyFileIsolationRedirection_Ustr
NtCreateTimer
NtDeleteBootEntry
ZwCancelTimer
ZwClearEvent
DbgUiStopDebugging
RtlGetOwnerSecurityDescriptor
RtlUnicodeToCustomCPN
ZwCancelIoFile
RtlSetInformationAcl
RtlSetOwnerSecurityDescriptor
NtOpenSemaphore
ZwCallbackReturn
RtlProtectHeap
ZwAddBootEntry
lz32
LZStart
LZClose
LZOpenFileW
LZInit
CopyLZFile
LZSeek
GetExpandedNameW
LZRead
LZDone
LZOpenFileA
LZCloseFile
LZCopy
GetExpandedNameA
LZCreateFileW
kernel32
GetVolumeInformationW
GetProfileIntA
SetDefaultCommConfigA
GetProfileSectionW
IsValidCodePage
VirtualUnlock
EnterCriticalSection
SetLocaleInfoW
ChangeTimerQueueTimer
IsDebuggerPresent
GlobalFree
GetSystemDefaultLCID
GetConsoleMode
VirtualAlloc
ReleaseSemaphore
IsValidLocale
_lopen
CreateMailslotW
GetOEMCP
LoadLibraryA
GetCPInfoExW
GetUserDefaultLCID
SetMailslotInfo
WaitNamedPipeW
OpenThread
SetTermsrvAppInstallMode
SetLastConsoleEventActive
GetOverlappedResult
ReadConsoleInputExW
ConvertDefaultLocale
DeleteFileW
GetConsoleKeyboardLayoutNameA
GetConsoleCommandHistoryLengthA
GetCalendarInfoW
SetConsoleInputExeNameA
FileTimeToDosDateTime
LeaveCriticalSection
msvcrt
exit
__getmainargs
__p__commode
__set_app_type
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ