Static task
static1
Behavioral task
behavioral1
Sample
28ac61b12eb2665e3043b9b61811622d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
28ac61b12eb2665e3043b9b61811622d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
28ac61b12eb2665e3043b9b61811622d_JaffaCakes118
-
Size
392KB
-
MD5
28ac61b12eb2665e3043b9b61811622d
-
SHA1
6af1a77213d342c7ba660ca61e10dff889a52189
-
SHA256
7f422871e7fd1940810bdcdf50dedf8803b1ffcd37586757b6e4f578abeff521
-
SHA512
f6305208d9c4030ad43a6fcc965281aa239188780a4c1d6169613d442f1a4bb1b5d00779ae704217c92566977e0caf385a4e65cfc9052bf4bf5b784d752ae14d
-
SSDEEP
6144:BjleTt2YbfUquWX7Ou5jvl2aE4FARgwVeV6AiWvrW0eJ/iyjvtziH5jg7G8I:BjsLbfPuWLdjvk4bUAip0elolgbI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28ac61b12eb2665e3043b9b61811622d_JaffaCakes118
Files
-
28ac61b12eb2665e3043b9b61811622d_JaffaCakes118.exe windows:4 windows x86 arch:x86
221bb5c0c40e8e3e614fe59b25352a8e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DebugBreak
FreeLibrary
VirtualLock
MoveFileW
lstrcpynA
Beep
UnhandledExceptionFilter
WritePrivateProfileStringA
SuspendThread
GetTapeStatus
GlobalFindAtomA
EnumCalendarInfoA
OpenMutexA
RemoveDirectoryW
QueryDosDeviceA
GetUserDefaultLangID
WritePrivateProfileSectionA
EndUpdateResourceA
GenerateConsoleCtrlEvent
GetPrivateProfileStringA
SetCurrentDirectoryA
GetFileInformationByHandle
PurgeComm
lstrcmpiA
GlobalDeleteAtom
FindCloseChangeNotification
CreateDirectoryExA
WritePrivateProfileStructA
GetThreadContext
IsBadReadPtr
SetThreadLocale
lstrcmpiW
ExpandEnvironmentStringsW
GetFileAttributesExA
RemoveDirectoryA
FreeEnvironmentStringsA
SetThreadPriorityBoost
FindNextChangeNotification
SetConsoleWindowInfo
SetEvent
CreateWaitableTimerA
GetTempPathW
SetSystemTime
SetupComm
ExitProcess
GetVolumeInformationW
VirtualFree
GetCommState
CreateProcessA
GetNumberFormatW
OutputDebugStringA
EnumCalendarInfoW
GetWindowsDirectoryA
FileTimeToLocalFileTime
VirtualProtect
GetVersionExA
GetCommandLineA
_lclose
PeekNamedPipe
CompareStringA
GetACP
SetConsoleActiveScreenBuffer
QueryDosDeviceW
GetProfileStringA
SetEnvironmentVariableW
GetLongPathNameA
LeaveCriticalSection
CreateMutexW
SetConsoleMode
LocalAlloc
SetFileAttributesA
VirtualAlloc
WaitNamedPipeA
VirtualUnlock
lstrcpyA
LoadLibraryExW
GetAtomNameA
EnumTimeFormatsW
MoveFileExA
GlobalAddAtomA
SetNamedPipeHandleState
user32
CreatePopupMenu
OpenDesktopW
DeferWindowPos
UnionRect
InvalidateRgn
LoadImageW
GetKeyState
SetClipboardData
EnumClipboardFormats
DrawTextA
SetActiveWindow
SetClassLongA
EnableMenuItem
IsDialogMessageW
EnumDesktopsA
GetClassNameW
MonitorFromWindow
RegisterClassA
ModifyMenuW
SetMenuItemBitmaps
EndPaint
SetMenuItemInfoW
InflateRect
MonitorFromPoint
AdjustWindowRect
SendInput
CopyAcceleratorTableA
SendDlgItemMessageA
GetForegroundWindow
SetMenu
GetMonitorInfoW
InsertMenuA
CheckMenuRadioItem
LoadAcceleratorsA
GetUserObjectInformationW
GetDoubleClickTime
MonitorFromRect
FillRect
GetClipboardOwner
LoadKeyboardLayoutW
IsRectEmpty
RemovePropA
gdi32
Polygon
AddFontResourceA
WidenPath
comdlg32
ReplaceTextA
ChooseColorA
PageSetupDlgW
advapi32
CryptDestroyKey
EnumServicesStatusW
CryptSetHashParam
RegRestoreKeyA
GetPrivateObjectSecurity
RegGetKeySecurity
ChangeServiceConfigW
RegQueryValueExW
SetSecurityDescriptorOwner
PrivilegeCheck
CryptExportKey
RegEnumKeyA
StartServiceA
ReportEventA
RegUnLoadKeyA
DuplicateToken
RegOpenKeyExA
CryptGetHashParam
RegRestoreKeyW
shell32
SHLoadInProc
FindExecutableW
SHFileOperationW
DragFinish
SHGetSpecialFolderLocation
ole32
OleConvertIStorageToOLESTREAM
GetRunningObjectTable
RevokeDragDrop
OleFlushClipboard
CoSwitchCallContext
oleaut32
SafeArrayPutElement
SysFreeString
shlwapi
PathRelativePathToA
SHGetValueW
StrCmpNW
SHAutoComplete
UrlIsW
PathFindOnPathW
PathGetDriveNumberA
PathCombineA
StrCpyW
PathIsNetworkPathW
SHEnumValueW
SHRegQueryUSValueW
PathGetCharTypeW
UrlGetPartA
PathStripToRootA
PathParseIconLocationW
StrRetToBufW
Sections
cgqqq Size: 336KB - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
qumykmk Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ykouc Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qwguum Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ