Static task
static1
Behavioral task
behavioral1
Sample
2b37175032af24b7551a096518675d85_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2b37175032af24b7551a096518675d85_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2b37175032af24b7551a096518675d85_JaffaCakes118
-
Size
352KB
-
MD5
2b37175032af24b7551a096518675d85
-
SHA1
68a9f885639da17c697fd82ac5f1e731fb883827
-
SHA256
83f5235a33f32fcea6165eb559999516dc3ef08e54cc5426764a9f2208696907
-
SHA512
819dd87bd8d48aa0ca5be5e2d971c3aa3c768170cee3b555cb971f2c249165c973133cae5ec3e77659eec4a3e618f319ad388468392a7e282d50575c628a4f9c
-
SSDEEP
6144:VgC5Gm56OBm62y2tDrCr9aNS5lLXpAAolqhkSQ6iQfuaHs:Jsm5RwrCr9btclpRQm+s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b37175032af24b7551a096518675d85_JaffaCakes118
Files
-
2b37175032af24b7551a096518675d85_JaffaCakes118.exe windows:4 windows x86 arch:x86
9169043ca07e6cbbfbd0628486cdeb0a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
_hread
GetEnvironmentStringsW
GetFileType
GetDriveTypeW
GlobalAddAtomA
GenerateConsoleCtrlEvent
CopyFileExW
IsBadWritePtr
GlobalFlags
DuplicateHandle
CompareStringW
EndUpdateResourceA
LocalFileTimeToFileTime
GetLongPathNameA
SetEnvironmentVariableA
WritePrivateProfileStringA
VirtualProtect
GetCommandLineW
CreateDirectoryExA
_lread
InitializeCriticalSection
ExpandEnvironmentStringsW
FindCloseChangeNotification
GetVersionExA
SetMailslotInfo
MoveFileExA
GetSystemDirectoryW
GetCommState
LocalSize
WritePrivateProfileSectionW
LeaveCriticalSection
GetFileAttributesA
GetCompressedFileSizeW
GetCommConfig
SetSystemTime
PeekConsoleInputW
LoadLibraryExW
GlobalFindAtomW
SetProcessShutdownParameters
GetPrivateProfileSectionW
SetThreadAffinityMask
GlobalGetAtomNameW
LocalLock
VirtualAllocEx
FreeResource
GetVolumeInformationW
SearchPathW
FormatMessageW
FlushFileBuffers
GetDateFormatA
WritePrivateProfileStructA
SetHandleCount
lstrcmpiW
CreateDirectoryW
GetNumberFormatW
OpenSemaphoreW
EnumResourceNamesA
GetProfileStringA
FlushConsoleInputBuffer
VirtualLock
SetThreadLocale
SuspendThread
FindNextChangeNotification
ReadConsoleOutputA
SetThreadPriorityBoost
QueryDosDeviceA
PulseEvent
SetCommTimeouts
OutputDebugStringA
WriteProcessMemory
GetCommandLineA
VirtualFree
ExitProcess
user32
wvsprintfW
DrawIconEx
SetClassLongW
EnumClipboardFormats
ArrangeIconicWindows
GetNextDlgGroupItem
ClientToScreen
MessageBoxExA
mouse_event
ChildWindowFromPoint
LoadCursorA
SetWinEventHook
InvalidateRgn
IsIconic
ExitWindowsEx
AdjustWindowRect
gdi32
CopyMetaFileA
CreateRectRgn
CreatePatternBrush
AbortDoc
BeginPath
SetBitmapDimensionEx
GetObjectA
PolyDraw
comdlg32
GetOpenFileNameA
advapi32
LookupAccountSidA
NotifyChangeEventLog
QueryServiceConfigA
BuildTrusteeWithNameW
RegEnumKeyExA
RegLoadKeyW
RegDeleteKeyA
RegEnumKeyExW
AdjustTokenPrivileges
CloseEventLog
SetNamedSecurityInfoW
GetExplicitEntriesFromAclW
EnumServicesStatusW
LogonUserA
ObjectCloseAuditAlarmW
LookupPrivilegeValueW
FreeSid
StartServiceA
GetNamedSecurityInfoA
CryptGetHashParam
NotifyBootConfigStatus
RegOpenKeyW
CryptHashData
LookupAccountSidW
DuplicateToken
RegUnLoadKeyA
AbortSystemShutdownA
EqualSid
RegCloseKey
PrivilegeCheck
SetSecurityDescriptorDacl
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
RegisterEventSourceA
ObjectCloseAuditAlarmA
SetFileSecurityW
shell32
SHBrowseForFolderA
DragAcceptFiles
SHLoadInProc
ole32
StgOpenStorage
ProgIDFromCLSID
OleCreateFromData
OleIsRunning
ReadFmtUserTypeStg
oleaut32
VariantCopy
SetErrorInfo
SafeArrayCreate
VariantChangeType
QueryPathOfRegTypeLi
SafeArrayPutElement
SysFreeString
SafeArrayGetLBound
comctl32
ImageList_Add
ImageList_LoadImageA
shlwapi
PathStripPathA
StrToIntExW
StrCatBuffA
setupapi
SetupDiCallClassInstaller
SetupOpenAppendInfFileW
SetupGetStringFieldW
SetupPromptReboot
SetupOpenInfFileA
SetupDiSetDeviceInstallParamsA
SetupDiEnumDeviceInterfaces
SetupDiClassGuidsFromNameW
SetupDiGetClassDevsExA
SetupGetInfFileListA
Sections
.text Size: 332KB - Virtual size: 330KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE