Static task
static1
Behavioral task
behavioral1
Sample
29ccecf15e5e61208cc31d19395fd486_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
29ccecf15e5e61208cc31d19395fd486_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
29ccecf15e5e61208cc31d19395fd486_JaffaCakes118
-
Size
360KB
-
MD5
29ccecf15e5e61208cc31d19395fd486
-
SHA1
19e7e227c22bdec7b54882933dedcfa64541f61c
-
SHA256
043d5cd781ab306c0db0add22f08b5fd40c3c8506dfcc24144bf847bffe2219b
-
SHA512
c012d9481474167a369910f52105b9d82fd207601d55962f7e9fe5206480137850684d97af089abcd5e15dd0c5023efa3d6f5544899a66412031d8b3b7fd4a47
-
SSDEEP
6144:pJEOM1rKDNeO1eCWVciESG7X7blgoreqdUaz63W1+iyT:xM1rSNeOUCWVAdecp+B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29ccecf15e5e61208cc31d19395fd486_JaffaCakes118
Files
-
29ccecf15e5e61208cc31d19395fd486_JaffaCakes118.exe windows:4 windows x86 arch:x86
069b9c0d81afe1efd79560593bf19cc1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalFindAtomA
SetEnvironmentVariableA
FormatMessageW
GetCurrentProcess
GetUserDefaultLangID
GetNumberFormatW
CreateMutexW
GetBinaryTypeA
CompareStringW
GetProfileStringA
SetTimeZoneInformation
GetFileInformationByHandle
SetErrorMode
LeaveCriticalSection
ExitProcess
ReadConsoleInputW
GlobalAddAtomW
SetLastError
RemoveDirectoryA
FreeEnvironmentStringsA
GlobalFlags
ReadConsoleOutputA
GetComputerNameW
ReadFile
UnhandledExceptionFilter
AllocConsole
LoadLibraryExW
GetVersionExA
SwitchToFiber
GetLargestConsoleWindowSize
GlobalDeleteAtom
VirtualAllocEx
ReleaseSemaphore
MultiByteToWideChar
ReadConsoleA
GenerateConsoleCtrlEvent
GetOverlappedResult
WriteProcessMemory
IsBadStringPtrA
EnumCalendarInfoA
GetShortPathNameA
QueryDosDeviceW
SetCommTimeouts
CreateDirectoryW
CreateEventA
FindNextChangeNotification
EnumCalendarInfoW
OpenFile
GlobalFindAtomW
GetTapeStatus
FindResourceExA
LoadResource
GlobalUnlock
GetTempPathW
GetCommandLineA
EndUpdateResourceA
VirtualProtect
user32
MessageBoxA
UnloadKeyboardLayout
OpenInputDesktop
CharLowerBuffW
CheckMenuRadioItem
GetDlgItemInt
OpenClipboard
DeferWindowPos
MapDialogRect
ScrollWindow
ToAscii
CreateCursor
PostThreadMessageW
CopyAcceleratorTableW
InsertMenuW
SetCaretPos
IsDialogMessageA
CreateDesktopA
ArrangeIconicWindows
GetGuiResources
ModifyMenuW
RegisterClassExW
ChangeMenuW
CreateDesktopW
DrawFocusRect
UnionRect
DrawStateW
EnumDesktopsW
DeleteMenu
EnumDisplaySettingsExW
RegisterDeviceNotificationA
SetWindowLongW
GetActiveWindow
GetTitleBarInfo
WindowFromDC
SendDlgItemMessageA
GetCursor
SetCursorPos
SetPropA
gdi32
SetBitmapDimensionEx
ResizePalette
TextOutW
GetStockObject
EndDoc
CreateBitmap
ExtTextOutW
GetViewportExtEx
comdlg32
FindTextW
GetOpenFileNameW
advapi32
RegisterEventSourceA
GetUserNameW
SetNamedSecurityInfoW
DeleteAce
LogonUserW
GetServiceKeyNameW
CryptGetKeyParam
GetNamedSecurityInfoA
RegRestoreKeyW
QueryServiceStatus
AbortSystemShutdownW
QueryServiceConfigW
AddAce
LookupPrivilegeDisplayNameA
shell32
SHAddToRecentDocs
SHGetSpecialFolderLocation
SHGetSettings
ShellExecuteA
ExtractIconA
ole32
OleLockRunning
ProgIDFromCLSID
oleaut32
SysAllocStringLen
SysStringLen
comctl32
ImageList_Replace
ImageList_Create
ImageList_DragLeave
ImageList_SetBkColor
shlwapi
StrCmpNW
PathRemoveExtensionW
StrCatBuffA
SHRegSetUSValueW
StrTrimW
PathAddBackslashW
StrCmpIW
SHRegWriteUSValueW
AssocQueryKeyW
wnsprintfW
PathIsDirectoryA
SHRegQueryUSValueW
SHDeleteValueW
SHRegCreateUSKeyW
setupapi
SetupDiGetDeviceInstallParamsA
SetupFindNextLine
SetupCloseLog
Sections
.text Size: 304KB - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE