Static task
static1
Behavioral task
behavioral1
Sample
3418849fb8d337a3a52c14abfc7b180d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3418849fb8d337a3a52c14abfc7b180d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3418849fb8d337a3a52c14abfc7b180d_JaffaCakes118
-
Size
376KB
-
MD5
3418849fb8d337a3a52c14abfc7b180d
-
SHA1
94cd9157f1a4d788346dee316ec9fce15845ef65
-
SHA256
d2fb9ad5c1ec41b97a7598bae13dc54d29050ddb589d95174f8985fa3e6c55c8
-
SHA512
252734a53c00f38289d24296f6ecbdc45c9d153348ad77a04307d6fa0a541378d5cbf75c5d9bcb1c1f6a5db193dc9a0f54492a064d0e2fac8fac8e2d173c78d8
-
SSDEEP
6144:FDd9BN731mLsX0Q7RU4rmkGd7Zonb3JmzoUw+/jVGrRvF9YxLvwn:FDdHN73q673rmL7ZonDURGRt9Qw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3418849fb8d337a3a52c14abfc7b180d_JaffaCakes118
Files
-
3418849fb8d337a3a52c14abfc7b180d_JaffaCakes118.exe windows:4 windows x86 arch:x86
8746e8ded86f76efe2a38034432c80ac
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GlobalUnlock
GlobalLock
GlobalAlloc
InterlockedIncrement
InterlockedDecrement
lstrcmpA
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
VirtualQueryEx
GetLastError
VirtualQuery
GetVersionExA
lstrcpynA
lstrcpyA
lstrcpynW
lstrcpyW
WriteConsoleA
GetStdHandle
LocalFree
FormatMessageA
HeapFree
HeapAlloc
GetProcessHeap
ExpandEnvironmentStringsA
SearchPathA
FindClose
FindFirstFileA
FindNextFileA
GetFileSize
FlushFileBuffers
SetStdHandle
GetOEMCP
lstrlenW
GetStringTypeW
GetStringTypeA
GetCPInfo
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
SetFilePointer
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
TerminateProcess
LCMapStringW
LCMapStringA
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
IsBadWritePtr
HeapReAlloc
DeleteCriticalSection
HeapDestroy
VirtualAlloc
VirtualFree
InitializeCriticalSection
GetModuleHandleA
FreeLibrary
SearchPathW
CreateProcessW
ResumeThread
Beep
Sleep
GetWindowsDirectoryA
SetCurrentDirectoryA
GetModuleFileNameA
CopyFileA
FindResourceA
LoadResource
LockResource
HeapCreate
GetEnvironmentVariableA
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
RtlUnwind
SizeofResource
CreateFileA
ReadFile
CloseHandle
WriteFile
LoadLibraryA
GetProcAddress
lstrlenA
lstrcatA
GetACP
MultiByteToWideChar
user32
GetWindow
SendMessageA
MessageBoxA
FindWindowA
GetClientRect
RegisterClassExA
LoadCursorA
GetClassInfoExA
RegisterWindowMessageA
DefWindowProcA
GetWindowLongA
LoadStringA
GetWindowTextA
CallWindowProcA
DestroyWindow
GetDlgItem
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
CreateAcceleratorTableA
GetDesktopWindow
GetParent
GetClassNameA
RedrawWindow
SetWindowPos
IsWindow
BeginPaint
FillRect
EndPaint
GetDC
ReleaseDC
IsChild
GetFocus
SetFocus
GetSysColor
CreateWindowExA
GetWindowTextLengthA
SetWindowTextA
SetWindowLongA
wsprintfA
comctl32
InitCommonControlsEx
olepro32
ord253
advapi32
RegSetValueExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
LookupAccountSidA
GetTokenInformation
RegCreateKeyExA
RegDeleteValueA
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
ole32
CoUninitialize
OleUninitialize
CreateStreamOnHGlobal
OleInitialize
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoTaskMemFree
StringFromCLSID
CoTaskMemAlloc
OleLockRunning
CoInitialize
oleaut32
SysStringLen
SysAllocStringLen
VariantClear
SysAllocString
SysFreeString
LoadRegTypeLi
gdi32
GetStockObject
GetObjectA
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
GetDeviceCaps
DeleteDC
Sections
.text Size: 92KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 248KB - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ