Static task
static1
Behavioral task
behavioral1
Sample
2981e3ea55489ca3a6375e305ce29cba_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2981e3ea55489ca3a6375e305ce29cba_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2981e3ea55489ca3a6375e305ce29cba_JaffaCakes118
-
Size
43KB
-
MD5
2981e3ea55489ca3a6375e305ce29cba
-
SHA1
c4a1074457e707bd09ee538db587b1809269d0e7
-
SHA256
2dd502d84f45f76a4e9d4ae8fad4a11ef51c3a648a03fb666eadaea474f4c4fd
-
SHA512
5c329ca1b90627f57db4bacf560fb1d35f579c88c899f374ceece9a3168a8925e2c037e2c07a1b7adcf3d3635f0b948c9f627dfe0e3ba126c922142ddcf9fbd0
-
SSDEEP
768:Rbdrlz/HmUs2lOOYOGlJO1AD8yhMlvsscyLltJPLewbio6uDP0:RxRz/HopOGeunE1xttLd76E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2981e3ea55489ca3a6375e305ce29cba_JaffaCakes118
Files
-
2981e3ea55489ca3a6375e305ce29cba_JaffaCakes118.exe windows:5 windows x86 arch:x86
59f06c77174d3e5dab2db0ad5ca352fe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RevertToSelf
CreateProcessAsUserW
ImpersonateLoggedOnUser
OpenProcessToken
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
GetUserNameW
kernel32
LoadLibraryExA
SetEvent
GetCurrentProcessId
ExitProcess
GetModuleHandleA
lstrlenA
WaitForSingleObject
LockResource
DeviceIoControl
LocalFree
LocalAlloc
GetLastError
CreateEventA
OpenEventA
GetNumberFormatA
GetLocaleInfoA
LoadResource
GetCurrentThreadId
CreateThread
ExpandEnvironmentStringsW
FindResourceExW
GetDateFormatW
GetFileAttributesW
GetModuleFileNameW
GetModuleHandleW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetStringTypeExW
GetSystemDirectoryW
GetTempFileNameW
GetTempPathW
GetTimeFormatW
GetVersionExW
LoadLibraryExW
lstrcatW
lstrcmpW
lstrcpyW
lstrcpynW
OpenEventW
OpenFileMappingW
SearchPathW
SetCurrentDirectoryW
WritePrivateProfileStringW
MapViewOfFile
UnmapViewOfFile
Sleep
GetProfileStringW
lstrlenW
LoadLibraryW
GetProcessHeap
HeapFree
OpenProcess
lstrcmpiW
SetProcessWorkingSetSize
GetExitCodeProcess
CloseHandle
GetTickCount
GetProcAddress
FreeLibrary
CreateProcessW
DeleteFileW
CreateMutexW
CreateFileMappingW
CreateFileW
CreateEventW
CreateDirectoryW
GetVersionExA
gdi32
DeleteObject
user32
GetDlgItemTextW
GetMessageW
GetWindowLongW
GetWindowTextW
GetWindowTextLengthW
InsertMenuW
IsDialogMessageW
LoadCursorW
LoadIconW
LoadImageW
LoadMenuW
LoadStringW
PeekMessageW
PostMessageW
CallWindowProcW
PostThreadMessageW
RegisterClassExW
RegisterWindowMessageW
SendDlgItemMessageW
SendMessageW
SetDlgItemTextW
SetWindowLongW
SetWindowTextW
UnregisterClassW
WinHelpW
wsprintfW
wvsprintfW
GetClassLongW
FindWindowExW
DispatchMessageW
DialogBoxParamW
DefWindowProcW
CreateWindowExW
CreateDialogParamW
CharNextW
CharPrevW
CharLowerW
wsprintfA
GetSubMenu
GetMenuItemCount
DestroyMenu
GetWindowThreadProcessId
EnumThreadWindows
SendMessageA
GetParent
SetDlgItemTextA
SendDlgItemMessageA
GetDlgItem
RegisterWindowMessageA
PostMessageA
MessageBoxW
GetProcessWindowStation
GetThreadDesktop
GetUserObjectInformationW
PostQuitMessage
ScreenToClient
ChildWindowFromPointEx
GetDlgCtrlID
MsgWaitForMultipleObjects
TranslateMessage
IsWindow
IsWindowVisible
GetWindowRect
SystemParametersInfoA
SetWindowPos
GetCursorPos
DestroyWindow
SetMenuDefaultItem
TrackPopupMenu
ShowWindow
EnableWindow
GetLastActivePopup
SetForegroundWindow
EndDialog
CharUpperW
cmutil
CmAtolA
CmIsDigitA
ReleaseBold
CmFmtMsgA
MakeBold
UpdateFont
GetOSBuildNumber
CmWinHelp
CmLoadStringW
CmStrCatAllocW
??0CmLogFile@@QAE@XZ
??0CIniW@@QAE@PAUHINSTANCE__@@PBG111@Z
?GetPrimaryRegPath@CIniW@@QBEPBGXZ
CmStrCpyAllocW
?SetPrimaryRegPath@CIniW@@QAEXPBG@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBG@Z
?SetParams@CmLogFile@@QAEJHKPBG@Z
?Stop@CmLogFile@@QAEJXZ
?Log@CmLogFile@@QAAXW4_CMLOG_ITEM@@ZZ
CmFmtMsgW
?GPPI@CIniW@@QBEKPBG0K@Z
?DeInit@CmLogFile@@QAEJXZ
??1CIniW@@QAE@XZ
??1CmLogFile@@QAE@XZ
CmLoadIconW
CmLoadSmallIconW
CmParsePathW
IsLogonAsSystem
?GPPB@CIniW@@QBEHPBG0H@Z
?Clear@CIniW@@QAEXXZ
?SetHInst@CIniW@@QAEXPAUHINSTANCE__@@@Z
?SetFile@CIniW@@QAEXPBG@Z
?GPPS@CIniW@@QBEPAGPBG00@Z
?GetFile@CIniW@@QBEPBGXZ
CmBuildFullPathFromRelativeW
?SetPrimaryFile@CIniW@@QAEXPBG@Z
SzToWz
GetOSVersion
GetOSMajorVersion
CmMalloc
CmFree
?Start@CmLogFile@@QAEJH@Z
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE