SetMasterDatabase
Static task
static1
Behavioral task
behavioral1
Sample
game.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
game.exe
Resource
win10v2004-20240508-en
General
-
Target
0ac174d40d2813bdd877679852d1c76d_JaffaCakes118
-
Size
724KB
-
MD5
0ac174d40d2813bdd877679852d1c76d
-
SHA1
601ddd092ce1450f0ce16ccf9f1f41b66d82f90d
-
SHA256
495142fe0df131d474b901c8040945f367bc6a2966c67c4957edcb625a4ae9fc
-
SHA512
db52559b26e1992af0740a0e6b1307bf7af0255fa161dcecb8a2622a79d3a16ea7c5fe0f758e4eb0f1174e8851b11825bd82278e209e8b2714c59abf1c662c69
-
SSDEEP
12288:grcof92sU2xRNJXoNheP7PginM0mlxlUgsQvcn5JbtxI2J+c4+D8SnwZq61mXIJ1:gBfksUGRrXokDg2MPxljvc3Zxhfbc/1D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/game.exe
Files
-
0ac174d40d2813bdd877679852d1c76d_JaffaCakes118.rar
-
game.exe.exe windows:4 windows x86 arch:x86
9e22afd793f2d4f90fc8943aacde747d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
d3d9
Direct3DCreate9
dinput8
DirectInput8Create
winmm
timeEndPeriod
timeBeginPeriod
timeSetEvent
timeKillEvent
timeGetTime
kernel32
GetDriveTypeW
GetVolumeInformationW
GetLogicalDriveStringsW
DebugBreak
FormatMessageW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
MulDiv
WaitForMultipleObjects
LockResource
SizeofResource
LoadResource
FindResourceA
GetSystemInfo
GlobalMemoryStatus
FreeLibrary
GetCurrentProcess
GetThreadContext
GetCurrentThread
GetModuleFileNameW
GetModuleHandleA
Sleep
CreateMutexA
CreateEventA
CreateThread
GetLastError
ResetEvent
SetEvent
WaitForSingleObject
GetThreadLocale
GetLocaleInfoA
GetACP
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
TerminateThread
GetThreadPriority
SetThreadPriority
InterlockedExchange
VirtualAlloc
CreateSemaphoreA
VirtualFree
ReleaseSemaphore
lstrcmpiA
lstrlenA
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
GetTickCount
lstrcpyA
GetCurrentDirectoryA
GetModuleFileNameA
SetCurrentDirectoryA
FindFirstFileA
FindClose
LoadLibraryA
GetProcAddress
WriteFile
OutputDebugStringA
CreateFileA
GetFileSizeEx
SetFilePointerEx
InitializeCriticalSection
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetUnhandledExceptionFilter
GetPrivateProfileIntA
GetPrivateProfileStringW
QueryPerformanceFrequency
QueryPerformanceCounter
ReadFile
RemoveDirectoryA
CreateDirectoryA
DeleteFileA
SetErrorMode
GetCurrentThreadId
MoveFileExA
GetPrivateProfileStringA
GetFileAttributesExA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetComputerNameA
SetFileAttributesA
GetTempPathA
GetTempFileNameA
GetFileAttributesA
VirtualQueryEx
GetCurrentProcessId
user32
SendDlgItemMessageA
GetMessageA
IsDialogMessageA
DispatchMessageA
wsprintfA
GetCursorInfo
SetWindowTextA
SetDlgItemTextA
MessageBeep
RegisterHotKey
LoadImageA
CreateDialogParamA
SetWindowPos
SetWindowLongA
GetWindowLongA
GetDlgItemTextA
CreateWindowExA
GetWindowRect
GetSysColor
GetDlgItem
DestroyIcon
EnableWindow
GetSysColorBrush
PostMessageA
GetDesktopWindow
ShowWindow
RegisterClassW
LoadCursorA
LoadIconA
MessageBoxW
SetForegroundWindow
MessageBoxA
DefWindowProcW
IsIconic
EndPaint
BeginPaint
DestroyWindow
SetCursorPos
UpdateWindow
SendMessageA
RegisterWindowMessageA
IsWindow
SendMessageTimeoutA
OffsetRect
SystemParametersInfoA
GetDlgCtrlID
MsgWaitForMultipleObjects
GetQueueStatus
PostThreadMessageA
ClientToScreen
AdjustWindowRect
GetKeyboardState
ToAscii
GetAsyncKeyState
SetFocus
SetCursor
ShowCursor
DestroyCursor
TranslateMessage
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
PostQuitMessage
PeekMessageA
PeekMessageW
DispatchMessageW
GetClientRect
gdi32
SetBkMode
GetTextMetricsA
SetMapMode
DeleteObject
DeleteDC
CreateDIBSection
AddFontResourceA
SetBkColor
GetStockObject
SelectObject
CreateCompatibleDC
GetCharWidth32W
GetGlyphOutlineW
GdiFlush
TextOutW
RemoveFontResourceA
SetTextColor
CreateFontIndirectA
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CoFreeUnusedLibraries
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
VariantInit
VariantClear
msvcp80
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?length@?$char_traits@D@std@@SAIPBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?swap@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXAAV12@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
msvcr80
memmove_s
memset
_purecall
??_V@YAXPAX@Z
isspace
_vsnwprintf
rand
sscanf
isdigit
strncat
isalpha
fclose
fprintf
fopen
atof
fgets
atoi
memcpy
free
fflush
_splitpath
sprintf
floor
wcsncpy
strncmp
_CIacos
_finite
_stat64i32
clock
srand
atol
qsort
toupper
iswspace
_setjmp3
fgetws
_wfopen
__argc
__argv
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
longjmp
strchr
sqrt
tanh
tan
cos
sin
wcsstr
_CIpow
swscanf
_ftol
_aligned_malloc
_aligned_free
fread
fseek
ftell
fwrite
printf
vsprintf
strstr
strrchr
_snprintf
_getcwd
_strtime
_strdate
strtok
_findfirst64i32
_findnext64i32
_findclose
_CIfmod
malloc
realloc
_mbsstr
_mbslwr
_stricmp
_strnicmp
tolower
strcspn
_time64
_atoi64
ferror
_errno
fputc
_fdopen
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_time32
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_vsnprintf
strncpy
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_invalid_parameter_noinfo
_wcsicmp
_wcsupr
memmove
imagehlp
SymSetOptions
SymGetOptions
SymFunctionTableAccess
SymGetSymFromAddr
SymGetModuleInfo
SymLoadModule
SymInitialize
SymGetLineFromAddr
StackWalk
version
GetFileVersionInfoA
VerQueryValueA
wsock32
htons
WSAGetLastError
shutdown
recv
send
connect
__WSAFDIsSet
inet_addr
closesocket
inet_ntoa
WSASetLastError
WSACleanup
WSAStartup
select
sendto
recvfrom
ntohs
gethostname
socket
setsockopt
bind
getsockname
ioctlsocket
ntohl
gethostbyname
htonl
dbghelp
MiniDumpWriteDump
shlwapi
PathFindFileNameA
PathCanonicalizeA
PathRemoveFileSpecW
comctl32
ord17
d3dx9_41
D3DXPlaneTransform
D3DXSaveSurfaceToFileA
D3DXSaveTextureToFileA
D3DXCreateEffect
D3DXCreateEffectPool
D3DXLoadSurfaceFromMemory
D3DXLoadSurfaceFromSurface
advapi32
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
GetUserNameA
shell32
ExtractAssociatedIconA
ShellExecuteA
SHGetFolderPathA
SHFileOperationA
Exports
Exports
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SHARED Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SKIDROW Size: 108KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
skidrow.nfo