Static task
static1
Behavioral task
behavioral1
Sample
49b34ea5567e54458c8552691a97eec3_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
49b34ea5567e54458c8552691a97eec3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
49b34ea5567e54458c8552691a97eec3_JaffaCakes118
-
Size
329KB
-
MD5
49b34ea5567e54458c8552691a97eec3
-
SHA1
8ef31a5b5235ae0c473daab09f2f185469d903a1
-
SHA256
76c6463ca0f5d34168991cef2d4b21056da372f83d333f0454567b5d904620d6
-
SHA512
a6c0004aeb0344eb0fdeac35a2a04c651bd70a1bdeea5bbbf0cc17f2945420937739a53bf69a3615d53f3563550c4bbb033c09c739e18d54384401c3239f4397
-
SSDEEP
6144:MZqGvLwJn0LFjjaeRREZVWDNEB4X06Sta3X1f+mElJ:MAGvUJn0LFj+yEeDNnX0xy2mE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49b34ea5567e54458c8552691a97eec3_JaffaCakes118
Files
-
49b34ea5567e54458c8552691a97eec3_JaffaCakes118.exe windows:5 windows x86 arch:x86
7996352d3da4f1f30a4b7541a9170d73
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoTaskMemFree
CoInitialize
PropVariantClear
CoUninitialize
CoCreateInstance
PropVariantCopy
CoTaskMemAlloc
ntdll
RtlInitializeGenericTable
RtlIsGenericTableEmpty
RtlEnumerateGenericTableWithoutSplaying
RtlInitializeBitMap
RtlNumberGenericTableElements
NtQuerySystemInformation
DbgPrintEx
NtAddAtom
RtlLookupElementGenericTable
NtUnmapViewOfSection
NtAllocateVirtualMemory
DbgPrompt
NtMapViewOfSection
RtlClearBits
RtlSetBits
RtlInterlockedFlushSList
RtlDeleteElementGenericTable
RtlFindClearBitsAndSet
NtCreateSection
kernel32
RaiseException
GetTickCount
CancelIo
GetVersion
LoadLibraryW
FindClose
InterlockedCompareExchange
GetVersionExA
HeapAlloc
SetThreadPriority
ResetEvent
GetLastError
GetSystemInfo
VirtualAlloc
RtlCaptureStackBackTrace
CompareStringW
LoadResource
CreateFileW
LoadLibraryA
PulseEvent
ProcessIdToSessionId
FreeLibrary
DebugBreak
GetCurrentThreadId
GetSystemTimeAsFileTime
OutputDebugStringW
InterlockedFlushSList
DelayLoadFailureHook
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
Sleep
ReadFile
GlobalUnlock
SetLastError
WaitForMultipleObjects
GetCurrentProcessId
InterlockedExchange
GetProcAddress
GetProcessWorkingSetSize
WaitForSingleObjectEx
CreateFileMappingW
LocalAlloc
QueryDepthSList
GetFileSize
GetVersionExW
SizeofResource
DisableThreadLibraryCalls
GetOverlappedResult
QueryPerformanceCounter
GetModuleHandleW
InterlockedExchangeAdd
GetSystemDirectoryW
OutputDebugStringA
VirtualLock
GetProcessHeap
HeapFree
MulDiv
WideCharToMultiByte
InterlockedPushEntrySList
CreateFileMappingA
SetProcessWorkingSetSize
GetACP
UnhandledExceptionFilter
GetCurrentProcess
LeaveCriticalSection
FindFirstFileW
CreateThread
CreateFileA
VirtualFree
CreateEventW
TryEnterCriticalSection
SetUnhandledExceptionFilter
TerminateThread
HeapReAlloc
InitializeSListHead
RtlUnwind
CreateWaitableTimerW
LockResource
WriteFile
SleepEx
ExitProcess
SystemTimeToFileTime
SetWaitableTimer
LocalFree
UnmapViewOfFile
DuplicateHandle
QueryPerformanceFrequency
VirtualQuery
SetEvent
GetCurrentThread
FindResourceW
DeleteCriticalSection
GetProcessId
IsProcessorFeaturePresent
GetModuleHandleA
CloseHandle
InterlockedIncrement
MapViewOfFile
WaitForSingleObject
lstrcmpiA
GetFullPathNameA
IsDebuggerPresent
gdi32
SelectObject
GetDIBits
RectInRegion
CreateDCW
CreateICW
CreateDIBSection
RealizePalette
GetDCOrgEx
GetDeviceCaps
CreatePalette
GdiEntry13
SelectPalette
DrawEscape
OffsetRgn
GetRegionData
DeleteObject
BitBlt
SetLayout
DeleteDC
CreateCompatibleDC
CreateRectRgnIndirect
GetSystemPaletteEntries
CreateCompatibleBitmap
GetRgnBox
CombineRgn
advapi32
RegOpenKeyA
RegCloseKey
GetTraceLoggerHandle
GetTraceEnableLevel
TraceEvent
TraceMessage
UnregisterTraceGuids
GetTraceEnableFlags
RegisterTraceGuidsW
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
msvcrt
_CItan
wcsstr
_copysign
_XcptFilter
_vsnprintf
_CIatan
_wtof
_resetstkoflw
_CIsin
_vsnwprintf
_CIexp
_adjust_fdiv
_CIlog
_CIfmod
strchr
_errno
calloc
_controlfp
tolower
_isnan
_initterm
_CIsqrt
memset
memcpy
qsort
_amsg_exit
_CIsinh
isxdigit
_CIacos
_CIasin
memmove
_wcsicmp
_CIcos
_purecall
isdigit
free
atoi
_clearfp
_finite
setlocale
_CItanh
realloc
_stricmp
isalnum
wcstol
_unlock
_lock
_wtoi
_strdup
modf
wcschr
_fpclass
isalpha
ceil
clock
atof
floor
_CIpow
malloc
toupper
_CIatan2
isspace
__dllonexit
_CIcosh
_onexit
user32
GetDesktopWindow
GetDC
EnumDisplayMonitors
EqualRect
GetWindowLongW
GetClientRect
DispatchMessageW
PeekMessageW
ReleaseDC
RegisterWindowMessageW
GetWindowDC
IntersectRect
GetMonitorInfoW
GetGuiResources
TranslateMessage
EnumDisplaySettingsW
SetRect
OffsetRect
IsWindow
CopyRect
PostMessageW
UpdateLayeredWindow
EnumDisplayDevicesW
SystemParametersInfoW
IsRectEmpty
SetLayeredWindowAttributes
MsgWaitForMultipleObjects
ClientToScreen
InvalidateRect
rpcrt4
RpcServerInqCallAttributesW
RpcBindingVectorFree
RpcEpRegisterW
RpcStringFreeW
RpcStringBindingComposeW
NdrAsyncClientCall
RpcAsyncGetCallStatus
I_RpcExceptionFilter
RpcServerRegisterIfEx
RpcAsyncCompleteCall
RpcBindingFromStringBindingW
UuidCreate
NdrAsyncServerCall
RpcSsDestroyClientContext
RpcAsyncInitializeHandle
RpcBindingFree
RpcServerUseProtseqW
RpcAsyncCancelCall
UuidToStringW
RpcServerUnregisterIfEx
RpcServerInqBindings
RpcBindingSetAuthInfoExW
psapi
GetProcessMemoryInfo
Sections
.text Size: 303KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE