Static task
static1
Behavioral task
behavioral1
Sample
496796f41bdbdbbaeff53807dfbcdd43_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
496796f41bdbdbbaeff53807dfbcdd43_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
496796f41bdbdbbaeff53807dfbcdd43_JaffaCakes118
-
Size
264KB
-
MD5
496796f41bdbdbbaeff53807dfbcdd43
-
SHA1
1055928ddcb957e799eb6c966ebc6e3dcd17db8a
-
SHA256
31ecf17e33560ae9fd822f5a7d1d22cb72b043b353b97c483cc71d94346790a2
-
SHA512
052738fdae9b592f4e0ec1bc7d248877dae0d53c128a4fd932d56208908056cffea82b131c2b01c61c035ba43134bd431d6d165d195f9a09246b89e31352bd83
-
SSDEEP
6144:HOr4crAe2Af6d22BYe9FyPvdE9R7ffr5rI5+46p:HOrCttmeUPvdWR73Cm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 496796f41bdbdbbaeff53807dfbcdd43_JaffaCakes118
Files
-
496796f41bdbdbbaeff53807dfbcdd43_JaffaCakes118.exe windows:4 windows x86 arch:x86
2eb0e855bfb5a0461c38d8e5866a8af9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetMalloc
SHChangeNotify
SHGetFolderLocation
SHGetFileInfoA
shlwapi
PathRemoveFileSpecW
comdlg32
ChooseColorA
GetFileTitleA
GetSaveFileNameA
kernel32
GetFullPathNameA
GetPrivateProfileIntW
RemoveDirectoryW
GetPrivateProfileSectionA
GetStdHandle
WriteConsoleA
lstrcmpA
WritePrivateProfileStringW
OpenProcess
GetCurrentProcess
GetNumberFormatW
FlushFileBuffers
GlobalSize
SetProcessWorkingSetSize
LCMapStringA
GetVersionExW
GlobalFindAtomA
WriteFile
CreateSemaphoreA
LockFile
CreateDirectoryW
SetFilePointer
WritePrivateProfileSectionA
TlsFree
IsBadWritePtr
GetFileType
GetExitCodeProcess
HeapDestroy
CreateFileMappingA
CreateProcessW
ConvertDefaultLocale
OpenFileMappingA
LCMapStringW
UnmapViewOfFile
CreateFileA
GetDriveTypeA
LockResource
InterlockedCompareExchange
GetSystemPowerStatus
CreateMutexW
MoveFileExA
InitializeCriticalSection
MapViewOfFileEx
ReadFile
LoadLibraryExA
IsBadCodePtr
ExitThread
lstrcatA
EnumResourceLanguagesW
GetFullPathNameW
OutputDebugStringW
GetFileAttributesA
Sleep
GetTimeZoneInformation
SizeofResource
SetCurrentDirectoryW
CopyFileW
GetCurrentDirectoryA
WaitForMultipleObjectsEx
GetTimeFormatW
GlobalReAlloc
GetCurrentThread
IsDebuggerPresent
LeaveCriticalSection
GetStartupInfoA
MoveFileA
SetFileTime
GetTempFileNameA
GetPrivateProfileStringW
QueryDosDeviceA
GetSystemWindowsDirectoryW
WriteConsoleW
IsValidCodePage
VirtualAlloc
GetModuleHandleA
SetEndOfFile
advapi32
OpenSCManagerW
GetTokenInformation
OpenServiceW
ControlService
RevertToSelf
AccessCheck
RegEnumValueW
RegFlushKey
StartServiceCtrlDispatcherW
ImpersonateSelf
ImpersonateLoggedOnUser
winspool.drv
GetPrinterDriverDirectoryA
gdi32
StretchBlt
ExtTextOutA
GetCharWidthW
GetDeviceCaps
version
VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoSizeA
oleaut32
SysFreeString
ole32
CoInitialize
GetHGlobalFromStream
OleSetContainedObject
OleCreateFromFile
OleGetIconOfClass
OleSaveToStream
user32
DdeFreeStringHandle
DefFrameProcA
DrawFrameControl
GetMonitorInfoW
CreateWindowExA
TabbedTextOutW
GetScrollRange
CreatePopupMenu
EnumThreadWindows
IsRectEmpty
WaitForInputIdle
SetKeyboardState
wvsprintfW
SystemParametersInfoW
AttachThreadInput
SetPropA
SetClassLongW
GetMessageW
GetPropW
DefWindowProcW
GetNextDlgGroupItem
OemToCharA
FlashWindowEx
SetDlgItemInt
RegisterWindowMessageA
TabbedTextOutA
GetSystemMenu
AppendMenuA
IsIconic
KillTimer
InsertMenuItemW
AdjustWindowRectEx
CharToOemA
FindWindowExW
DeleteMenu
GetWindowTextLengthA
GetScrollPos
GetUpdateRect
DdeClientTransaction
comctl32
ImageList_Replace
ImageList_AddMasked
ord17
InitCommonControlsEx
msvcrt
__p__commode
__p__fmode
__set_app_type
_except_handler3
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
isdigit
_wcslwr
_acmdln
_XcptFilter
_exit
_expand
srand
wcschr
tolower
calloc
rand
_mbsrchr
towupper
_strlwr
_wtoi64
_wtol
realloc
ceil
_setmbcp
longjmp
qsort
free
towlower
_CxxThrowException
iswspace
sprintf
ctime
_wcsicmp
_purecall
fread
_beginthreadex
_wtoi
wcslen
_controlfp
strncmp
strchr
_wcsnicmp
time
strstr
wcsspn
_ecvt
wcsncpy
_ltow
_splitpath
_stricmp
wcstok
wcstod
toupper
exit
wcstol
_snwprintf
wcscspn
floor
strncpy
iswalnum
malloc
fclose
wcsrchr
Sections
.text Size: 216KB - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ