Static task
static1
Behavioral task
behavioral1
Sample
3634e9a6019cbfc227e40e4fb1f936b1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3634e9a6019cbfc227e40e4fb1f936b1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3634e9a6019cbfc227e40e4fb1f936b1_JaffaCakes118
-
Size
233KB
-
MD5
3634e9a6019cbfc227e40e4fb1f936b1
-
SHA1
23d2873e450af85c12ddc59fb646f714c594dea3
-
SHA256
7aaef1f76afa12f8334736227ecbaa3dffb5e836e3ea17b4f604c11005f7f14d
-
SHA512
2651140a1b9291c5db340bf7b5f91024817749449f7b970f09139750f9c9d49c878dbedf29d9ebd180199a8567a92b095eb9cd5546eb1b8b3dc0b205828f06bf
-
SSDEEP
1536:bqUo/2URxQquckgzowgSbwEEZXwogQHa8Lx5nBL2WCN8nF:WUo+UfVYtWQHa+x5nBL8N8nF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3634e9a6019cbfc227e40e4fb1f936b1_JaffaCakes118
Files
-
3634e9a6019cbfc227e40e4fb1f936b1_JaffaCakes118.exe windows:5 windows x86 arch:x86
07ca08d0b502e0f533b2d5a52cc2ae5a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFileExistsA
AssocQueryStringA
wnsprintfA
StrNCatA
SHDeleteKeyA
StrToIntA
StrStrIA
userenv
GetProfilesDirectoryA
kernel32
ReadFile
lstrcatA
FindFirstFileA
lstrcmpiA
RemoveDirectoryA
FindClose
GetModuleFileNameA
FindNextFileA
GetTempPathA
DeleteFileA
lstrcpyA
SetFilePointer
SetEndOfFile
GetVersionExA
Sleep
GetModuleHandleA
GetVolumeInformationA
ExitProcess
SetErrorMode
GetTickCount
CreateThread
MultiByteToWideChar
SetLastError
GetSystemTimeAsFileTime
CreateProcessA
InitializeCriticalSectionAndSpinCount
HeapSize
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
RtlUnwind
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
GetFileAttributesA
WriteFile
MoveFileExA
lstrlenA
GetFileSize
CreateFileA
LocalFree
CloseHandle
VirtualQuery
LoadLibraryA
GetProcAddress
GetLastError
OpenProcess
ExpandEnvironmentStringsA
GetProcessHeap
HeapFree
GetCurrentProcess
HeapAlloc
FreeLibrary
lstrcmpA
lstrcpynA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
RaiseException
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
TlsFree
TlsSetValue
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
user32
RegisterClassExA
PostQuitMessage
SendDlgItemMessageA
FillRect
LoadBitmapA
LoadIconA
SendMessageA
BeginPaint
IsDialogMessageA
GetWindowRect
MessageBoxA
GetWindowLongA
CreateWindowExA
GetDlgItem
DefWindowProcA
SetWindowPos
ShowWindow
DispatchMessageA
AdjustWindowRectEx
SystemParametersInfoA
SetWindowTextA
UpdateWindow
LoadCursorA
ExitWindowsEx
GetUserObjectSecurity
GetWindowThreadProcessId
GetShellWindow
EndPaint
GetMessageA
DestroyWindow
TranslateMessage
gdi32
BitBlt
GetTextExtentPoint32A
SetTextColor
CreateFontA
SetBkMode
SelectObject
CreateCompatibleDC
GetObjectA
GetStockObject
CreateSolidBrush
TextOutA
DeleteDC
advapi32
RegEnumKeyA
RegEnumValueA
RegDeleteValueA
RegQueryInfoKeyA
RegCreateKeyA
RegDeleteKeyA
RegSetValueExA
AdjustTokenPrivileges
GetUserNameA
IsValidSid
GetSecurityDescriptorOwner
LookupPrivilegeValueA
ConvertSidToStringSidA
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
shell32
SHFileOperationA
ShellExecuteA
SHGetFolderPathA
ord680
ShellExecuteExA
Sections
CODE Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ