Static task
static1
Behavioral task
behavioral1
Sample
2b950a7332c9852d152b95471993fe38_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2b950a7332c9852d152b95471993fe38_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2b950a7332c9852d152b95471993fe38_JaffaCakes118
-
Size
216KB
-
MD5
2b950a7332c9852d152b95471993fe38
-
SHA1
bb1c7a86dc44ac337144e492a8e493ba9f67979d
-
SHA256
d9cbf1667dd4317644849ac84cfbcb2ef5066d5aa7260c77c39a4b29fe83b578
-
SHA512
ac2fe1b200055b2e7fc0b6cd5db2964de38e55804445c82334a3915289a9be4e8ba244df515aeb8864c352a76e08c6ca6fade10e5169ad84921fb4dcf8217ad6
-
SSDEEP
3072:yIGw4Fnqu15laSnXl/s03531iVoJ06MJ6omALAPp7aKTyVnMySRkJK:2FnRHlaSXy03loAeJ6a4oK2VnBSRF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b950a7332c9852d152b95471993fe38_JaffaCakes118
Files
-
2b950a7332c9852d152b95471993fe38_JaffaCakes118.exe windows:4 windows x86 arch:x86
89b3e8bcf4eb127213530a9f5620b11c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocaleInfoA
CopyFileA
GetSystemDirectoryA
CreateProcessA
OpenFile
GetVersionExA
FindResourceA
LoadResource
SizeofResource
IsBadCodePtr
IsBadReadPtr
FlushFileBuffers
SetStdHandle
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
FreeLibrary
GetSystemDefaultLCID
CreateFileA
LCMapStringA
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TlsGetValue
SetLastError
LocalFree
TlsSetValue
HeapSize
GetCurrentProcess
TerminateProcess
GetFileType
GetStdHandle
SetHandleCount
SetFilePointer
ReadFile
WriteFile
ExitProcess
GetVersion
GlobalLock
GlobalUnlock
GlobalFree
lstrcatA
lstrcpyA
LoadLibraryA
GetProcAddress
InitializeCriticalSection
IsDBCSLeadByte
lstrcpynA
lstrcmpiA
LoadLibraryExA
SetUnhandledExceptionFilter
LCMapStringW
GetShortPathNameA
GetModuleFileNameA
GetModuleHandleA
lstrlenW
lstrlenA
MultiByteToWideChar
CreateMutexA
GetCommandLineA
GetCurrentThreadId
InterlockedIncrement
GetLastError
CloseHandle
FreeEnvironmentStringsA
UnhandledExceptionFilter
TlsAlloc
InterlockedDecrement
HeapFree
DeleteCriticalSection
GetStartupInfoA
RaiseException
HeapReAlloc
EnterCriticalSection
HeapAlloc
RtlUnwind
InterlockedExchange
Sleep
LeaveCriticalSection
user32
LoadStringA
WinHelpA
PostThreadMessageA
DefWindowProcA
DestroyMenu
DispatchMessageA
GetMessageA
PostMessageA
CreateWindowExA
RegisterClassA
CharNextA
RegisterWindowMessageA
PostQuitMessage
ReleaseDC
GetSystemMetrics
DialogBoxParamA
GetDC
SetTimer
DestroyIcon
KillTimer
TrackPopupMenu
GetCursorPos
SetForegroundWindow
DestroyWindow
AppendMenuA
CreatePopupMenu
InsertMenuA
wsprintfA
CallWindowProcA
SetWindowLongA
GetParent
EnableWindow
EnumChildWindows
GetSystemMenu
GetWindowRect
GetSubMenu
GetMenuStringA
SetWindowTextA
GetDlgItem
EndDialog
GetDlgCtrlID
EnableMenuItem
SendMessageA
FindWindowA
gdi32
GetDIBits
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetBkColor
BitBlt
SetTextColor
DeleteObject
DeleteDC
advapi32
AllocateAndInitializeSid
FreeSid
RegOpenKeyA
RegEnumValueA
RegQueryValueExA
RegSetValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
shell32
ShellExecuteExA
Shell_NotifyIconA
ole32
CLSIDFromProgID
CoCreateInstance
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoUninitialize
CoSuspendClassObjects
oleaut32
SysFreeString
SysAllocStringByteLen
SysStringLen
SysAllocString
SysStringByteLen
VarUI4FromStr
RegisterTypeLi
VariantClear
LoadTypeLi
comctl32
DestroyPropertySheetPage
CreatePropertySheetPageA
hccutils
LoadSTRING
LoadBITMAP
LoadIMAGE
GetMyRegKey
LoadDialogString
ReleaseClassDevice
IsDisplayValid
EnumDeviceByClass
FindResources
Sections
.text Size: 100KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 16KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.yrdata Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE