Static task
static1
Behavioral task
behavioral1
Sample
17625bcc2c9c2e7ef8dfdf2abd4b5c02_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
17625bcc2c9c2e7ef8dfdf2abd4b5c02_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
17625bcc2c9c2e7ef8dfdf2abd4b5c02_JaffaCakes118
-
Size
612KB
-
MD5
17625bcc2c9c2e7ef8dfdf2abd4b5c02
-
SHA1
965caacc41f4141d02935a2c8573a40f0a4ecdd1
-
SHA256
4795f6d74344650fdb18a170482af6e5d567e00632add1be5b2984a7b7f2dd86
-
SHA512
ef5731244d8aa5cbbcb973238dd8fcabb1fcd872c4d6859bbff1ff21093cccf71600a3a433e47434bb5e67ddd2fa554f24bb0cef64d242897f7b8c43cda4447b
-
SSDEEP
6144:VdaFnZmF4JEbeDP18bn0afnwxe4kbNuTj5Jy1LYEzGyOxuXahhPyktYcb:TUnZmGWI9Pafwxe9NuTj5Jy1LNSL6k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17625bcc2c9c2e7ef8dfdf2abd4b5c02_JaffaCakes118
Files
-
17625bcc2c9c2e7ef8dfdf2abd4b5c02_JaffaCakes118.exe windows:4 windows x86 arch:x86
9523d6a1c5104c8a881a5d6cf5a42abc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedDecrement
FreeLibrary
InterlockedIncrement
FindClose
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
WaitForSingleObject
CloseHandle
SystemTimeToFileTime
GetLocalTime
GlobalReAlloc
GetCommandLineW
LocalFree
LocalAlloc
lstrlenA
CompareStringA
InterlockedExchange
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
GetLastError
SetLastError
ReadFile
WriteFile
SetNamedPipeHandleState
MulDiv
RaiseException
SetErrorMode
GetLogicalDrives
ReleaseMutex
user32
UpdateWindow
InvalidateRect
SetForegroundWindow
IsIconic
DestroyWindow
TranslateMessage
EndPaint
FillRect
GetClientRect
BeginPaint
SetParent
ShowWindow
IsWindow
SetCursor
GetWindowRect
SetTimer
InvalidateRgn
GetDesktopWindow
GetParent
GetWindowPlacement
BringWindowToTop
DestroyCursor
GetDC
ReleaseDC
SetWindowRgn
MessageBeep
GetKeyState
ShowCursor
GetSystemMetrics
KillTimer
GetCursorPos
PtInRect
SetFocus
RedrawWindow
SetCapture
ScreenToClient
SetWindowPos
ReleaseCapture
MoveWindow
IsWindowVisible
PostQuitMessage
shell32
SHGetFolderPathW
DragAcceptFiles
SHGetSpecialFolderPathW
DragFinish
ole32
CoCreateInstance
OleRun
CoInitialize
CoUninitialize
CoGetClassObject
shlwapi
PathAddBackslashW
PathFindExtensionW
PathRemoveFileSpecW
PathAppendW
upi6commondll
?IsWMP9OrHigherInstalled@@YAHXZ
?OpenImgFile@@YAPAVMagPicture@PubImage@@PBGHP6GIPAX@Z1H@Z
?IsSupportFile@@YAHPBGH_K@Z
?CalcFitInSize@@YAXJJAAJ0@Z
?GetModulePath@CPathEx@@SAPBGPAUHINSTANCE__@@PAG@Z
?CheckDirectXVersion@@YAJXZ
?GetModulePath@@YAHPAUHINSTANCE__@@PAG@Z
?InitResAUI@CAuiResource@@QAEHPBGPAUHINSTANCE__@@@Z
??0CAuiResource@@QAE@XZ
??1CAuiResource@@UAE@XZ
?ResLoadString@CAuiResource@@QAEHIPAGH@Z
?PIMessageBoxEx@@YAHPBG0PAUHWND__@@I@Z
?GetAudioLenghtbyCMovie@@YAJPBG@Z
?OpenImgToGetInfo@@YAPAVMagPicture@PubImage@@PBGK@Z
?SetWindowCorner@@YAXPAUHWND__@@QAY0BAE@GHK@Z
?GetUIFile@CPathEx@@SAXPBGPAGPAUHINSTANCE__@@@Z
?GetScreenDisplayBits@@YAJXZ
?GetOpenSaveFileName@@YAHPAUHWND__@@HPAGKKPBG2_KPAUPICC_IO_OUTOPTION@@PBX@Z
?ResetScreenSaver@@YAXXZ
?PopInstallDXDlg@@YAHPAUHWND__@@@Z
magcore
Mag0Release
Mag0GetObjDataC
Mag0UnregisterClass
Mag0RegisterClass
Mag0GetType
Mag0Retain
Mag0CreateObj
Mag0Inter
magpltfm
magStrCopy
maguiengine
Mag0GetGValue
Mag0SetGValue
maguiinter
Mag0SMCreateSurfaceW
Mag0SMGetSurfaceManage
Mag0SMGetEnvironment
magpcmac
MagWaitEvent
MagWaitThread
MagCloseThreadRef
MagCreateEvent
MagSetEvent
MagEnterCriticalSection
MagLeaveCriticalSection
MagCloseEvent
MagDeleteCriticalSection
Mag0FSRRelease
MagInitCriticalSection
Mag0FSExpRelease
Mag0FSExpCalculateFSRCreate
Mag0FSExpCreateExp
MagCreateThread
magappframework
?ExitInstance@CMagApp@@MAEXXZ
?CreateAUI@CMagApp@@QAEPAVMagAUI@PubMagic@@PBG@Z
?InitInstance@CMagApp@@MAEHXZ
?GetEnvironment@CMagApp@@QAEPAUMagAppEnvironment@@XZ
?GetWindow@CMagWindow@@QAEPAUHWND__@@XZ
?SetMagMainWnd@CMagApp@@QAEXPAVCMagMainWind@@@Z
?UnionMessageValue@CMagWindMessageMap@@MAEII@Z
?PreRegisterMagWndClass@CMagWindow@@MAEXAAUtagWNDCLASSEXW@@@Z
?QuitAppAfterDestroyed@CMagWindow@@MAEHXZ
?WillClose@CMagWindow@@MAEXXZ
?PreCreate@CMagWindow@@MAEHXZ
?SetDefaultCallBackName@CMagWindow@@UAEXPADW4MagDefaultCallBackKind@@@Z
?Create@CMagWindow@@UAEHPBGPAUtagRECT@@PAUHWND__@@@Z
?Create@CMagWindow@@UAEHPBDPAUtagRECT@@PAUHWND__@@@Z
?RegisterCallBacks@CMagWindow@@MAEXXZ
??0CMagWindow@@QAE@XZ
??1CMagWindow@@UAE@XZ
?PreCreateWind@CMagWindow@@MAEXAAUtagCREATESTRUCTW@@@Z
?ProcessMessage@CMagWindow@@UAEJIIJAAH@Z
?SetMinSize@CMagWindow@@QAEXUtagSIZE@@@Z
?SetMagWindowStyle@CMagWindow@@QAEXK@Z
?GetMagWindowStyle@CMagWindow@@QAEKXZ
?GetCatalog@CMagWindow@@QAEPAVMagPanel@PubMagic@@XZ
?DidCreate@CMagWindow@@MAEXXZ
?DidClose@CMagWindow@@MAEXXZ
?ShowWindow@CMagWindow@@QAEXH@Z
?IsWindowEnabled@CMagWindow@@QAEHXZ
?AddCallBack@CMagCallbackMap@@IAEXPADP6AJPAVMagElement@PubMagic@@JQBX2@Z@Z
?AddCallBack@CMagCallbackMap@@IAEXPADJP6AJPAVMagElement@PubMagic@@QBX2@Z@Z
?RegisterCallBacks@CMagDialog@@MAEXXZ
?OnCancel@CMagDialog@@MAEXXZ
?OnOK@CMagDialog@@MAEXXZ
?EndDialog@CMagDialog@@UAEXH@Z
?DoModal@CMagDialog@@UAEHXZ
?DidClose@CMagDialog@@MAEXXZ
?WillClose@CMagModalWnd@@MAEXXZ
?AskForClose@CMagWindow@@MAEHXZ
?DidCreate@CMagDialog@@MAEXXZ
?PreCreateWind@CMagModalWnd@@MAEXAAUtagCREATESTRUCTW@@@Z
?SetDefaultCallBackName@CMagDialog@@UAEXPADW4MagDefaultCallBackKind@@@Z
??0CMagDialog@@QAE@XZ
??1CMagDialog@@UAE@XZ
?ProcessMessage@CMagDialog@@UAEJIIJAAH@Z
?QuitAppAfterDestroyed@CMagMainWind@@UAEHXZ
??1CMagMainWind@@UAE@XZ
??0CMagMainWind@@QAE@XZ
?GetElementByName@CMagWindow@@QAEPAVMagElement@PubMagic@@PBDH@Z
?IsZoomed@CMagWindow@@QAEHXZ
?GetApp@CMagApp@@SAPAV1@XZ
??0CMagApp@@QAE@XZ
?Run@CMagApp@@UAEHXZ
?GetInstance@CMagApp@@QAEPAUHINSTANCE__@@XZ
??1CMagApp@@UAE@XZ
msvcrt
difftime
atol
_strnicmp
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
wcsncmp
wcschr
_waccess
memset
swscanf
iswdigit
iswalpha
_wcslwr
_wcsnicmp
_getcwd
_stat
fgetws
memcmp
time
srand
rand
_purecall
fseek
ftell
_wfopen
memcpy
strlen
strchr
printf
sscanf
fclose
fflush
fread
fopen
_errno
getenv
toupper
strncpy
fprintf
vfprintf
free
malloc
realloc
_vsnprintf
_iob
fwrite
_snprintf
wcscmp
_itow
swprintf
wcsncpy
wcsrchr
memmove
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
floor
_wtoi
_wcsicmp
_CxxThrowException
wcsstr
_wsplitpath
wcscat
_ftol
??2@YAPAXI@Z
wcslen
wcscpy
__CxxFrameHandler
msvcp60
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
oleaut32
GetErrorInfo
VariantInit
SysAllocString
VariantCopy
VariantChangeType
VariantClear
SysFreeString
Sections
.text Size: 368KB - Virtual size: 367KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 40KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rrdata Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE