Static task
static1
Behavioral task
behavioral1
Sample
0b8b53d55eb9f65d85e4a9d1cb9e9c0c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0b8b53d55eb9f65d85e4a9d1cb9e9c0c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0b8b53d55eb9f65d85e4a9d1cb9e9c0c_JaffaCakes118
-
Size
89KB
-
MD5
0b8b53d55eb9f65d85e4a9d1cb9e9c0c
-
SHA1
4bc54ae6797e3a4c7418bbb64525331f9cc415b2
-
SHA256
d49609153cb25fd8e52619c547c36890b1a87f36a980c30275deb8cc7a3a44d8
-
SHA512
0d5d0bde3e7c59de400d9d9f425e51c4a01a229b4b3a995aa4ccbc496fb4c7282a3571ffa05ee075a09aedc85488ce7f4d0b9e009186eb90cedd4f3adaa0e8a6
-
SSDEEP
1536:8JoCTE1r5lBYfqf3P62r00a5HsTTx2ORFK7ULAD5:wZY1r5MfiQv5Ha2ORFGULY5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b8b53d55eb9f65d85e4a9d1cb9e9c0c_JaffaCakes118
Files
-
0b8b53d55eb9f65d85e4a9d1cb9e9c0c_JaffaCakes118.exe windows:5 windows x86 arch:x86
a19234b6ae0ec38914acebf111d4c344
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gamevancelib32
?GetExcludedUrlsSeq@@YGKPAD@Z
GetUuid
?HostToIP@@YGHPAD0K@Z
?Base64EncodeFunc@@YGHPAD0H@Z
?CanCheckPopup@@YGHPAU_TSharedStruct@@PAU_tagPopupInfo@@@Z
?GetWindowsProductId@@YGHPADK@Z
?GetDefaultCfgServer@@YGHPADK0@Z
?IsWindowsVista@@YAHXZ
?GetGeoIPCountryCode@@YGHPADH0@Z
?SetLastPopupTimeNT@@YGHU_FILETIME@@PAD@Z
?string_table_delete_all@@YGHPAUst_string_table@@@Z
?SetExcludedUrlsSeq@@YGHKPAD@Z
?SetPopupCountNT@@YGHKPAD@Z
SetAdLocation
?ParsePopupData@@YGHPADPAU_tagPopupData@@@Z
?SetCheckPopServer@@YGHPAD0@Z
?SetClientId@@YGHPAD0@Z
?SaveQoolPopups_T@@YGHPAU_tagQoolPopup@@PAD@Z
?SetLastPopupTimeT@@YGHU_FILETIME@@PAD@Z
?SaveQoolPopups_NT@@YGHPAU_tagQoolPopup@@PAD@Z
?SetPopupInProgress@@YGHH@Z
?SetPopupCountT@@YGHKPAD@Z
?SetGeoIPCountryCode@@YGHPAD0@Z
?ShowPopupInDefaultBrowser@@YGHKPAU_tagPopupData@@@Z
?ShowPopupInDefaultBrowser2@@YGHKPAU_tagPopupData@@@Z
?AddFiredPid@@YGHPAPAU_tagQoolPopup@@HH@Z
?xml_parse_config@@YGHPADPAPAU_tagCONFIG_STRUCT@@PAHPAUst_string_table@@@Z
?SetPopupsStatusDisabled@@YGHKPAD@Z
?string_table_add@@YGHPAUst_string_table@@PAD@Z
?SetDefaultCfgServer@@YGHPAD0@Z
?GetLastPopupTimeNT@@YG?AU_FILETIME@@PAD@Z
?GetLastPopupTimeT@@YG?AU_FILETIME@@PAD@Z
?RemoveOldPopups@@YGHPAPAU_tagQoolPopup@@@Z
?IsPopupInProgress@@YGHXZ
?GetClientId@@YGHPADK0@Z
?DeleteRecoveryModule@@YAXXZ
?GetUniqueClientId@@YGHPADK@Z
GetAdLocation
?GetClientInstallDate@@YG?AU_FILETIME@@XZ
?FindBrowserWindow@@YGPAUHWND__@@K@Z
?IsPopupEngineDisabled@@YGHXZ
?IsHeaderFirstRun@@YGHXZ
?GetCfgFilePath@@YGHPADH@Z
?LoadFiredPopups_T@@YGHPAPAU_tagQoolPopup@@PAD@Z
?GetOSVersionString@@YGHPADK@Z
?string_table_alloc@@YGHPAPAUst_string_table@@@Z
?IsWindowsMe@@YGHXZ
?GetWS2SendFrame@@YGHPADK@Z
?GetIEVersion@@YGXPADK@Z
?ScheduleFileUpdate@@YGXPAD0@Z
?FileTimeSecondsBetween@@YG_JU_FILETIME@@0@Z
?GetHardwareHashCrcHex@@YGHPADH@Z
?GetPopupCountT@@YGKPAD@Z
?GetCrc64@@YGHPADK0@Z
?ParsePacketContent@@YGHPAU_tagHttpData@@PAUHWND__@@PAUst_string_table@@2PAPAU_tagQoolPopup@@3H@Z
?ModuleFromAddress@@YGPAUHINSTANCE__@@PAX@Z
?LoadFiredPopups_NT@@YGHPAPAU_tagQoolPopup@@PAD@Z
?SetClientInstallDate@@YGXU_FILETIME@@@Z
?GetPopupCountNT@@YGKPAD@Z
?GetCheckPopServer@@YGHPADK0@Z
?SetCrc64@@YGHPAD0@Z
shlwapi
StrNCatA
StrStrA
wnsprintfA
StrStrIA
kernel32
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetLocaleInfoA
HeapSize
RtlUnwind
VirtualAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LeaveCriticalSection
QueryPerformanceCounter
VirtualFree
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
GetModuleHandleW
GetStartupInfoA
GetCommandLineA
EnterCriticalSection
IsBadReadPtr
ReleaseMutex
OpenMutexA
ExitProcess
lstrlenA
MapViewOfFile
lstrcpynA
HeapAlloc
SetUnhandledExceptionFilter
SystemTimeToFileTime
HeapFree
GetTickCount
GetProcessHeap
GetSystemTimeAsFileTime
Sleep
CreateProcessA
IsBadWritePtr
GetLastError
GetProcAddress
GetLocalTime
LoadLibraryA
CreateFileMappingA
GetModuleFileNameA
CreateMutexA
CloseHandle
GetCurrentProcessId
LocalFree
lstrcpyA
lstrcatA
HeapReAlloc
VirtualQuery
WriteFile
HeapDestroy
HeapCreate
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObject
user32
GetLastInputInfo
DefWindowProcA
CreateWindowExA
TranslateMessage
SendMessageA
ShowWindow
PostQuitMessage
RegisterClassExA
SetTimer
GetMessageA
DestroyWindow
RegisterWindowMessageA
PostMessageA
DispatchMessageA
FindWindowA
KillTimer
advapi32
SetNamedSecurityInfoA
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegCloseKey
RegDeleteValueA
ole32
CoInitialize
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ