Static task
static1
Behavioral task
behavioral1
Sample
3e9dc96c63db0313adc3c7e5a2ea8e45_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3e9dc96c63db0313adc3c7e5a2ea8e45_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3e9dc96c63db0313adc3c7e5a2ea8e45_JaffaCakes118
-
Size
80KB
-
MD5
3e9dc96c63db0313adc3c7e5a2ea8e45
-
SHA1
abd9ddead0fc57005f6eda771761b517cedabb71
-
SHA256
4197995d9e7a7f34ed56303083d18338f7716380f85cc205cf0c8dca8f0816d2
-
SHA512
b42606491920eefd720427053794112a7fa8ee3ad6b437e528799bed417349d02de58ac5ee2496e4c2efc5d808116e18f36d311ce8677878a35dc329602c9f71
-
SSDEEP
1536:0ysaUUI+OLn8QK8phWslZVf/9cJQMdr/I994XnTfpHrTsvx+:0ys4I+2n/K8lZ9cVS4XnTfpHre8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e9dc96c63db0313adc3c7e5a2ea8e45_JaffaCakes118
Files
-
3e9dc96c63db0313adc3c7e5a2ea8e45_JaffaCakes118.exe windows:4 windows x86 arch:x86
9914c8f2518923b3f1590e8b452b41d8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpyW
MulDiv
lstrlenW
lstrcmpW
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
FindResourceW
SetLastError
GlobalFree
GlobalHandle
LockResource
LoadResource
GetModuleHandleW
SizeofResource
MultiByteToWideChar
lstrcmpiW
lstrcpynW
DebugBreak
HeapSize
GetVersionExA
LoadLibraryA
GetLastError
ExitProcess
GetModuleHandleA
GetStartupInfoW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
lstrcatA
lstrcpyA
lstrlenA
GetModuleFileNameA
RtlUnwind
VirtualQuery
GetProcAddress
CopyFileA
WinExec
FreeLibrary
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryExW
HeapReAlloc
RaiseException
user32
TranslateMessage
GetMessageW
PeekMessageW
CreateDialogIndirectParamW
SetWindowContextHelpId
MapDialogRect
EndPaint
GetDesktopWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
FillRect
SetCapture
ReleaseCapture
GetSysColor
DialogBoxParamW
RegisterWindowMessageW
GetClassInfoExW
DispatchMessageW
RegisterClassExW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
DefWindowProcW
FindWindowW
ShowWindow
wsprintfW
FindWindowExW
PostQuitMessage
IsDialogMessageW
GetDlgItem
KillTimer
SetTimer
SendMessageW
SetWindowLongW
DestroyWindow
UnregisterClassW
GetWindow
GetWindowRect
SystemParametersInfoW
GetClientRect
CreateWindowExW
CreateAcceleratorTableW
GetActiveWindow
GetSystemMetrics
LoadImageW
CharNextW
GetClassNameW
RedrawWindow
IsWindow
DestroyAcceleratorTable
GetFocus
IsChild
SetFocus
LoadCursorW
BeginPaint
MapWindowPoints
SetWindowPos
GetParent
GetWindowLongW
EndDialog
CallWindowProcW
MessageBoxA
gdi32
CreateSolidBrush
GetStockObject
GetObjectW
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
DeleteObject
SelectObject
advapi32
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
shell32
SHGetFolderPathA
ole32
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
CoTaskMemAlloc
StringFromGUID2
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
oleaut32
VariantClear
VarUI4FromStr
DispCallFunc
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysStringByteLen
SysAllocString
VariantInit
SysStringLen
SysFreeString
SysAllocStringLen
shlwapi
PathAppendA
comctl32
InitCommonControlsEx
Sections
.text Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.WYCao Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ