Static task
static1
Behavioral task
behavioral1
Sample
0eff7e53763a16f83814b48894d4f8ec_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0eff7e53763a16f83814b48894d4f8ec_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
0eff7e53763a16f83814b48894d4f8ec_JaffaCakes118
-
Size
5.1MB
-
MD5
0eff7e53763a16f83814b48894d4f8ec
-
SHA1
2db7483b54879d8333799108f7095f4ac8e59419
-
SHA256
835edc7c8c3fdd18cd2039daf5c7f3b2bf9d4ea5aac54360cb49adeea3ac7f17
-
SHA512
e8edcdb2093d91ba4cf2101b96b3653cf99acbb8024eb7be4afeddb8d06cb9bff81d958fba198f9c40b6526a57b81a58bc653ac5b152dfe6bdcf359ffb4b26d2
-
SSDEEP
98304:8DeQJ9tdjZN07iQ9Q1Pjx9zPuBJEITtjz5pK+0jctkX/dmLZKex5zdJ:8SI9vs7+Pjx9zG5N7eXlMKezz
Malware Config
Signatures
Files
-
0eff7e53763a16f83814b48894d4f8ec_JaffaCakes118.exe windows:5 windows x86 arch:x86
ff142bca4a0ea7a334f64b6af7399908
Code Sign
44:2a:6a:89:0d:c8:9e:9c:42:01:6e:12:34:b6:ab:a7Certificate
IssuerCN=Root AgencyNot Before13/04/2015, 00:24Not After31/12/2039, 23:59SubjectCN=Glendeo,O=GlenSoft,1.2.840.113549.1.9.1=#0c0f67616c616e64656f4071712e636f6de8:df:12:f2:40:d5:60:47:12:98:6e:e9:c2:a8:2a:b7:c7:d2:b0:f1Signer
Actual PE Digeste8:df:12:f2:40:d5:60:47:12:98:6e:e9:c2:a8:2a:b7:c7:d2:b0:f1Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegQueryValueExW
user32
MessageBoxA
MessageBoxA
kernel32
Sleep
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
gdi32
UnrealizeObject
version
VerQueryValueW
ole32
CreateStreamOnHGlobal
comctl32
InitializeFlatSB
shell32
ShellExecuteW
comdlg32
GetOpenFileNameW
winspool.drv
OpenPrinterW
msvcrt
isxdigit
wsock32
ntohs
ntdll
NtQueryInformationProcess
Exports
Exports
5 ͑��ɜ����(KiqN4�T��n�hˀ�����Qi�YУB���"���x(�'a� �% J��,!*�w� 0p3���'[�ν��<��R~�N�&�m��Q ~{�ÂKL|x�?L��KU����Dep�~��մR���ܲ�Ғdzb)�Qit�)}^��;�����m���i��!���#�d{FS�WIV��q���c�<�*x�r�&���"�'��"�{1���p��)��xs����x���@v�ɫV����H}�M��\�%<� 1V[N�W9�}�h8�5���JK鿎^<����lD�ڨ��v��1��_�.�g�ts7���������jq=p�6��M&g ����a�ƨ�f�mXF;�ڮ�@��5��g��i���yN��]�'�tژ��l�X�=S���J�N*��+�{������"r��X��+�"��]�n��Z\稱P�[�Y}s4����X�� ]�2λ���(-�uY����A4.4&�lb�����Fk�2CDwgc\3T�SY�B�N��`��.�]N��_9�}f�����@ذTr<xa�����4�g�4gC�u�G4`1za����փ����)��n�5�z���*\��$j�B�^_@�B�����v���2+PH��F��U�~�}�C*RJr�`��4.��[�SE0p!9�)��y���?!h�����z� CB:-�K;Uz�� ����8,ȸ?�� &.b��-c���=#����e)p�f�����Ґ�C�nٹy�l�S��Hg� �����'h�$��v�r�g\���*Q�+���z�4� �(��ר|��>]���w�q�gG4���J���^�8�Vj'dop}p]^Q/�\|� ��@uP��3�?����+�SU�UQ��λ��&�P�; ���5�q���]R埴 F_�ܣ�N�瘾a�OgXA�Θ��o�Y�s����sK��+2�z��hl�����p���Q+W�_N��s�����_�2*�Pf�f��Y�d��b��� Ի��V�D��A+��͆W8<{l� t[����{i>��S�m��v�u�#D��;��#��εJ��a��Bz:N'�)�����z�B�y�/G���抺�����8�3�' g��D�4���g����va����)���1wj-e�W�P�"�h/+,��Ga�7Š vө�F�x�K�iBxtun��X?���r���{@݆)�M�D:��P��;+���Ң���kw]���ION�i�u��l ʤi+ 6w�K*����� G��-#b!;�}�ص�q���j����� ���b��6?��$��>E��[T�F�,N$���D��&���=}��3�c4�#w[\Eص�$+1�F.���j���6����!����@|�l���j��+� ��m�ccZ�~�z��S5�^��MJr��8.�����k�1�a�/AY���':� *�y�T՟�����ZG@�� ���� ̹[�d�D_�0<���i0A�:[z%���o�۸j1�C΅�#�?�[lf����}"�]��w^�AZ��Y�� �fS�$ �ٗ� ����W.�>������3��I�Ջv͊�`����u�й3�0�Q.\�H�8���Ah�Cd�B�����Ux�r���O�5w��$�:X���O���e肈��3�Ez��9�n����$ _� k��о�&�J_2��� �KW�`V��Z�q�^3�(\J�� ���N��_�,E����ME? b��s��������C��4fs�m�����s�ݹ����.��@���pϚ�0����� �J$���BP���f#�z}���R� %w���������q�izOl�g�����WMV:$�|1Aa�Pڽ꧅A����� �A |�'��� �(��&�}�.%��\[�ݕ\��JO)�Qu>�u�8�1�M�|�n�V%�R����]�u�J���@l3 ��|2�� ��:��N�i?��r�Kl��e�-����+|�����M�����Y�@@3���i<sڂ3�H#@y\�����=S>�T�^>�<����1��h3�j�+�e�B�C6�b�t��MC��u%���7����R��U�F[��Р��^B�N4qG+�:|d���K\�p��]Q��Ψ������N�� ܖ�?V"���Ħ��J0Ă�}/�w��5w����d%��-NX��g0����z!"���<��wͦ��=8U������m�@��ۦ *���A��}F&���%��PI�w#�fb,��w0ۃx\��X���f����a8/'B_sDA¼� }D�����ns%����/H���!a�����k��V�QҔCLK죠��Q����/z�������u�f+� H̀*����Y�M})O�N�9����=x(����g�>�ʅ�n�v2�p���~#3�l�i`a#��L#���P9�P��f���"��*��3,.x�m܌���+��;8�H��� ֫���k�Q�@�?�D{�rJ��c�R���0������?�ƁkOY��Ay"��z���q!LaZ? � 8�k�y)�;��d��H���{P��w'N�"��G0��n��w���,dx�U/~�I�� !����ɔ������7�N�F-ո�����JjP�8Kh����e*A:\L���cN#9�xc(������_�}�#�0w� �!<"���@2��8��`?����i$�r6Ǫ�6�E�����~8�av��"ĎQ�\�T��i���ą���F�����<��շ���N*�B�?�Vփ/b�H~(:^q��S������a��% �^༼�7��IL���#iSO�<��Q��5�h�b~�k1���9R�W�� *��,[tEP����gWr:���g=8 ���.��Q� ���of��rzJ����5��T������O����VS':΄o�L O�����~s�M}�#�QYD�,����K�k�-��d����S5���6��n0��q������jo�4���� ��ţ�.7L}�P�fS1���І�p�P#^��Mb��t�)Ɉ
TMethodImplementationIntercept
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 102KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: - Virtual size: 93B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 76B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 306KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ