Static task
static1
Behavioral task
behavioral1
Sample
36cffb40b56eae703c54fb94af8726a7_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
36cffb40b56eae703c54fb94af8726a7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
36cffb40b56eae703c54fb94af8726a7_JaffaCakes118
-
Size
224KB
-
MD5
36cffb40b56eae703c54fb94af8726a7
-
SHA1
7025e2648a4a9fd5518c5dc46b86930dbd00d845
-
SHA256
5ebd87e54192dcd937634238ee6886a6d1d63224c2ba6e157f7cfe61d10ec4fb
-
SHA512
1d7023742ca7393d427fc1b30d570a0432b1ae675723ffc411fb63c47dc60b28c285a7dc2d12eed7ef6b4b45d84418b044e6e68287fb6c885ba76f42a6247900
-
SSDEEP
3072:Ki1QKx+5ZdHprV7MQPXcP9FUBhlD2rci/jSDxPvz7ElRsjnfNeFxp1fGt0vWn87:KMQKxeJuKcP9Svl/mSNvz7HMJ1fvj7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36cffb40b56eae703c54fb94af8726a7_JaffaCakes118
Files
-
36cffb40b56eae703c54fb94af8726a7_JaffaCakes118.exe windows:4 windows x86 arch:x86
0061a5fb1fe5687ab265fc6d8afdbd07
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFileExistsA
PathAppendA
PathFileExistsW
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
ws2_32
htons
htonl
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
setupapi
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
kernel32
FindClose
MultiByteToWideChar
WideCharToMultiByte
RemoveDirectoryW
GetDiskFreeSpaceA
GetLogicalDriveStringsA
GetCurrentProcess
GetDriveTypeA
GetModuleHandleA
Process32FirstW
CloseHandle
GetExitCodeProcess
Process32NextW
lstrlenA
GetProcessHeap
GetModuleFileNameA
HeapAlloc
Sleep
HeapFree
DeviceIoControl
CreateProcessA
CreateToolhelp32Snapshot
Process32First
ProcessIdToSessionId
Process32Next
OpenProcess
lstrcmpiA
VerSetConditionMask
GetCommandLineA
OutputDebugStringA
CreateSemaphoreA
LocalFree
SetEvent
InterlockedIncrement
InterlockedDecrement
CopyFileW
FindFirstFileA
LocalAlloc
GetPrivateProfileStringA
SetConsoleCtrlHandler
GetCurrentThreadId
CreateEventA
CreateThread
TerminateProcess
GetTickCount
WaitForMultipleObjects
GetLocalTime
GetFileSize
DeleteFileA
GetFileAttributesA
SetFileAttributesA
CopyFileA
Thread32First
Thread32Next
FindNextFileA
GetWindowsDirectoryA
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidCodePage
GetOEMCP
GetCPInfo
SetFilePointer
InitializeCriticalSection
GetStdHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WaitForSingleObject
CreateDirectoryW
FindNextFileW
FindFirstFileW
CreateFileA
DeleteFileW
InterlockedExchange
FreeLibrary
SetFileAttributesW
LoadLibraryA
GetLastError
GetFileAttributesW
GetProcAddress
SetLastError
VerifyVersionInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile
SetHandleCount
GetFileType
GetConsoleCP
GetConsoleMode
ResetEvent
WriteFile
HeapSize
VirtualFree
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
ReadFile
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoA
RaiseException
RtlUnwind
ExitProcess
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
FlushFileBuffers
user32
UnregisterDeviceNotification
RegisterDeviceNotificationA
PostThreadMessageA
DispatchMessageA
GetMessageA
wsprintfA
CharNextA
advapi32
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegisterServiceCtrlHandlerExA
RegOpenKeyExA
SetServiceStatus
CloseServiceHandle
DeleteService
ControlService
StartServiceA
CreateServiceA
QueryServiceStatus
QueryServiceConfigA
UnlockServiceDatabase
ChangeServiceConfigA
OpenServiceA
QueryServiceLockStatusA
LockServiceDatabase
OpenSCManagerA
StartServiceCtrlDispatcherA
LookupPrivilegeValueA
OpenProcessToken
DuplicateTokenEx
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserA
shell32
SHCreateDirectoryExA
SHGetFolderPathA
ShellExecuteA
Sections
.text Size: 164KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE