f:\ovlae
Static task
static1
Behavioral task
behavioral1
Sample
36ce69da0c78d51972c9b6b64749a16c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
36ce69da0c78d51972c9b6b64749a16c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
36ce69da0c78d51972c9b6b64749a16c_JaffaCakes118
-
Size
513KB
-
MD5
36ce69da0c78d51972c9b6b64749a16c
-
SHA1
4eb23112a8a66726ca6f51788f2b314eb4c3040d
-
SHA256
d6368fd8e3290091b2b72dc611df4ba5de323ae00e6b7cf70ab3380509dfd9f5
-
SHA512
763584965060b7fecb1cc20938ae8dac1a34654b6dab984e238ecaece5270871a3ddc63e87ac5ea10c5cfc03a0318f53dba1c2811c4ca98d42f98efe51923728
-
SSDEEP
12288:KzYwu+QAROgq9CiHaX9VmAsm8SR2lqYUglw:Axi9CiHmnsFSR20YUyw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36ce69da0c78d51972c9b6b64749a16c_JaffaCakes118
Files
-
36ce69da0c78d51972c9b6b64749a16c_JaffaCakes118.exe windows:4 windows x86 arch:x86
850d68684d8952d46a264bf50bef807f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCurrentProcessId
GetFileType
GetTickCount
OpenMutexA
SetThreadIdealProcessor
CreateDirectoryA
LeaveCriticalSection
TerminateProcess
ExitProcess
FindAtomW
GetCommandLineW
WideCharToMultiByte
LoadLibraryA
HeapReAlloc
SetStdHandle
RtlUnwind
GetLocaleInfoW
GetTimeFormatA
TlsFree
TlsSetValue
CompareStringA
SetLastError
FlushFileBuffers
GetSystemInfo
CompareStringW
GetStdHandle
GetSystemDefaultLCID
HeapSize
CloseHandle
HeapFree
GetStringTypeW
TlsAlloc
GetStartupInfoA
GetLogicalDriveStringsA
InitializeCriticalSection
WritePrivateProfileSectionA
GetModuleFileNameW
GetDateFormatA
GlobalDeleteAtom
HeapDestroy
GetCPInfo
GetVersionExA
EnterCriticalSection
GetEnvironmentStrings
CreateMutexA
SetEndOfFile
GetCurrentProcess
GetACP
UnhandledExceptionFilter
WriteProfileStringA
HeapAlloc
SetEnvironmentVariableA
InterlockedExchange
GetTimeZoneInformation
GetEnvironmentStringsW
GetModuleFileNameA
WritePrivateProfileStringW
WriteFile
GetCommandLineA
GetStringTypeA
GetLocaleInfoA
SetThreadContext
GetSystemTimeAsFileTime
IsValidCodePage
GetModuleHandleA
TlsGetValue
HeapCreate
IsBadWritePtr
MultiByteToWideChar
GetCurrentThreadId
DeleteCriticalSection
SetFilePointer
GetProcAddress
VirtualFree
VirtualProtect
LCMapStringW
FreeEnvironmentStringsA
IsValidLocale
SetHandleCount
VirtualQuery
FreeEnvironmentStringsW
EnumSystemLocalesA
GetLastError
GetCurrentThread
LCMapStringA
QueryPerformanceCounter
GetUserDefaultLCID
GetOEMCP
FindResourceExW
ReadFile
GetStartupInfoW
VirtualAlloc
shell32
RealShellExecuteW
DragFinish
ShellHookProc
DragQueryPoint
user32
TranslateMDISysAccel
UnhookWinEvent
RealGetWindowClass
RegisterClassExA
GetUserObjectInformationA
LoadStringW
GetClipboardSequenceNumber
ValidateRgn
ChangeMenuW
MsgWaitForMultipleObjects
SubtractRect
GetMonitorInfoA
CreateAcceleratorTableA
InsertMenuItemA
DlgDirSelectExW
GetMenuStringW
GetNextDlgGroupItem
ToUnicodeEx
EnumPropsExA
GetDlgItemTextA
RegisterClassA
GetMenuContextHelpId
advapi32
RegQueryValueA
CryptEnumProviderTypesA
CryptGenRandom
LookupAccountSidA
RegQueryMultipleValuesW
StartServiceA
RegNotifyChangeKeyValue
RegCloseKey
InitiateSystemShutdownW
ReportEventW
LookupAccountNameA
RegCreateKeyExW
GetUserNameA
RegSetValueExW
RegOpenKeyExW
CryptSetHashParam
RegDeleteKeyA
RegSaveKeyW
CryptGetDefaultProviderA
CryptDuplicateHash
CryptGetHashParam
RegOpenKeyW
gdi32
CreateBrushIndirect
SetViewportExtEx
CreateColorSpaceW
GdiSetBatchLimit
GetDeviceGammaRamp
FrameRgn
GetGlyphOutlineA
SwapBuffers
GetTextFaceA
GetEnhMetaFileA
GdiPlayDCScript
PatBlt
GetTextExtentPointW
SetMetaFileBitsEx
SetWindowExtEx
SetMiterLimit
FillPath
SetFontEnumeration
CreateRoundRectRgn
BeginPath
ExtTextOutW
SetICMProfileW
Polygon
SetRectRgn
comctl32
ImageList_DragMove
ImageList_GetDragImage
CreateStatusWindow
InitCommonControlsEx
DestroyPropertySheetPage
CreateToolbar
ImageList_Replace
ImageList_Create
Sections
.text Size: 330KB - Virtual size: 329KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ