Static task
static1
Behavioral task
behavioral1
Sample
0148e35609931d1baee92c35f2546066_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0148e35609931d1baee92c35f2546066_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0148e35609931d1baee92c35f2546066_JaffaCakes118
-
Size
328KB
-
MD5
0148e35609931d1baee92c35f2546066
-
SHA1
02cc829c1a4a16a8dd087c96c0d6d84ae10d1895
-
SHA256
53e6b7788fa1c98cbf0c3efdd25ab3aacafe5827c49e11874f79918ad2a863f8
-
SHA512
ca1376a466f76aca6669ccc5070cad0c40c90faed9d73d8878347596dbca7857db45493dfaf1938cdb4df00f1cb14a2cc0074915b100c2901cad8e14a79e62b5
-
SSDEEP
6144:7MeaPk+5irLkIMsb0wec9kHkdo24YNCpHHWoIybj2Ul76s4HeLOQp:7XaPUkIDb0ykHkI5HBbPl76s4+C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0148e35609931d1baee92c35f2546066_JaffaCakes118
Files
-
0148e35609931d1baee92c35f2546066_JaffaCakes118.exe windows:4 windows x86 arch:x86
c69c31f097b058887d08b053a26f3b0c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
oleaut32
VariantInit
VariantClear
VarR8FromI1
SysStringLen
SysFreeString
SysAllocString
ole32
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoSetProxyBlanket
CoInitialize
HMETAFILE_UserFree
kernel32
FindNextFileW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeW
GetExitCodeProcess
GetExitCodeThread
GetFileSize
GetFileTime
GetFileType
GetLocalTime
GetLocaleInfoW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetSystemDefaultLangID
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetUserDefaultLangID
GetVersionExW
GetVolumeInformationW
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
FindFirstFileW
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
LeaveCriticalSection
LoadLibraryExW
LocalFree
MapViewOfFile
MoveFileW
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
ReleaseMutex
RemoveDirectoryW
ResetEvent
SetEndOfFile
SetEvent
SetFileAttributesW
SetFilePointer
SetFileTime
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpW
lstrcmpiW
lstrcpynW
lstrlenA
lstrlenW
CloseHandle
FindClose
FileTimeToSystemTime
ExpandEnvironmentStringsW
EnterCriticalSection
DisableThreadLibraryCalls
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreateMutexW
CreateFileW
CreateEventW
CreateDirectoryW
CompareStringW
CompareStringA
CompareFileTime
HeapReAlloc
user32
CharLowerA
CharNextW
CharUpperA
CharUpperW
DispatchMessageW
GetActiveWindow
GetKeyboardType
GetWindowThreadProcessId
MsgWaitForMultipleObjects
PeekMessageW
PostMessageW
SendMessageW
TranslateMessage
ExitWindowsEx
shlwapi
StrChrW
StrCmpIW
StrCmpW
StrRChrW
StrStrIW
PathStripToRootW
PathRemoveBackslashW
PathIsUNCW
PathIsRootW
PathIsRelativeW
UrlGetPartW
UrlCombineW
StrToIntW
StrToIntExW
PathFindExtensionW
shell32
SHBrowseForFolderW
SHGetFolderPathW
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteW
advapi32
AdjustTokenPrivileges
AllocateAndInitializeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
CopySid
EqualSid
FreeSid
GetLengthSid
RegEnumKeyW
RegEnumKeyExW
SetNamedSecurityInfoW
RegSetValueExW
RegQueryValueExW
RegOpenKeyW
GetSecurityDescriptorDacl
GetSecurityDescriptorOwner
GetTokenInformation
IsValidSid
LookupPrivilegeValueW
LsaClose
LsaFreeMemory
LsaNtStatusToWinError
LsaOpenPolicy
LsaQueryInformationPolicy
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
wininet
InternetQueryOptionA
InternetGetConnectedState
InternetCrackUrlW
InternetCanonicalizeUrlW
setupapi
SetupDiOpenDevRegKey
CM_Get_DevNode_Registry_PropertyW
SetupDiOpenDeviceInfoW
SetupDiSetDeviceInstallParamsW
SetupDiSetSelectedDriverW
SetupFindFirstLineW
SetupGetStringFieldW
SetupOpenFileQueue
SetupOpenInfFileW
SetupScanFileQueueW
CM_Locate_DevNodeW
SetupCloseFileQueue
SetupCloseInfFile
SetupDiBuildDriverInfoList
SetupDiCreateDeviceInfoList
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiEnumDriverInfoW
SetupDiGetClassDevsW
SetupDiGetDeviceInstallParamsW
SetupDiGetDeviceInstanceIdW
SetupDiInstallDriverFiles
SetupDiGetDriverInstallParamsW
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
crypt32
CryptHashPublicKeyInfo
CertGetCertificateContextProperty
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 204KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ