Static task
static1
Behavioral task
behavioral1
Sample
634f4d9a149d831715f9254267e78af6_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
634f4d9a149d831715f9254267e78af6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
634f4d9a149d831715f9254267e78af6_JaffaCakes118
-
Size
345KB
-
MD5
634f4d9a149d831715f9254267e78af6
-
SHA1
f1aef7fc54da5525c0ffd7ae0e1640d1f608a58e
-
SHA256
98d18876783b4de63c7e47f9a8e482dffa99cceee794d15f6ecee9cd0243bbda
-
SHA512
85e8f4d552d6fa9968e14d25b992da50c573a071e1898681e1ff7b820d2a6e7e11e9982aa854b37f0cfd318baf3c4b05e0d68c529ab19a16b1f4bfa44a68a510
-
SSDEEP
6144:w8+rQm1LykSs+HKdkRmXGQWGlAgMMKCbLPiFS0gOo1mc9j+:w8yQmsl1qqmXYgMMp2n9o1mX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 634f4d9a149d831715f9254267e78af6_JaffaCakes118
Files
-
634f4d9a149d831715f9254267e78af6_JaffaCakes118.exe windows:4 windows x86 arch:x86
9e4201b7a43bba032d4ef03702976b36
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadResource
FindResourceExA
CreateProcessA
FlushInstructionCache
GetCurrentProcess
GlobalSize
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SetLastError
FreeLibrary
LoadLibraryA
WritePrivateProfileStringA
WritePrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetShortPathNameA
GetModuleFileNameA
lstrcmpiA
SetUnhandledExceptionFilter
GetCommandLineA
SizeofResource
FindResourceA
LoadLibraryExA
lstrcpynA
IsDBCSLeadByte
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
lstrcatA
FindClose
VirtualQuery
VirtualProtect
FindFirstFileA
SearchPathA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetWindowsDirectoryA
QueryPerformanceCounter
SystemTimeToFileTime
lstrcmpA
RemoveDirectoryA
CompareStringW
SetEndOfFile
GlobalReAlloc
IsBadReadPtr
GetOEMCP
GetACP
GetCPInfo
SetStdHandle
IsBadCodePtr
FlushFileBuffers
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
TerminateProcess
IsBadWritePtr
VirtualAlloc
VirtualFree
CompareStringA
GetModuleHandleA
GetProcAddress
GetDiskFreeSpaceA
GetFileSize
SetFilePointer
GetTempPathA
GetTempFileNameA
CopyFileA
ReadFile
DeleteFileA
CreateFileA
GetVersionExA
GetFileAttributesA
GetPrivateProfileStringA
QueryPerformanceFrequency
InterlockedDecrement
GetLastError
Sleep
WriteFile
SetFileTime
FormatMessageA
LocalFree
lstrcpyA
WideCharToMultiByte
GetTickCount
HeapCreate
ExitProcess
GetVersion
GetStartupInfoA
HeapAlloc
HeapReAlloc
HeapFree
RaiseException
RtlUnwind
GetCurrentThreadId
lstrlenA
EnterCriticalSection
LeaveCriticalSection
lstrlenW
InterlockedIncrement
MultiByteToWideChar
WaitForSingleObject
ResetEvent
SetEvent
CreateEventA
CreateThread
FindNextFileA
CloseHandle
user32
TranslateMessage
PeekMessageA
MessageBoxA
LoadStringA
GetDesktopWindow
wsprintfA
DefWindowProcA
DestroyWindow
SetWindowLongA
GetWindowLongA
CallWindowProcA
CreateWindowExA
CharLowerBuffA
RegisterClassExA
DispatchMessageA
IsWindow
PostMessageA
MsgWaitForMultipleObjects
SendMessageA
GetMessageA
CharNextA
PostThreadMessageA
GetClassInfoExA
LoadCursorA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyA
RegQueryValueA
RegCloseKey
CryptReleaseContext
CryptAcquireContextA
CryptDestroyKey
CryptDestroyHash
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
ole32
CoCreateGuid
CLSIDFromProgID
CoCreateInstance
StringFromCLSID
StringFromGUID2
CoTaskMemRealloc
CoRegisterClassObject
CoRevokeClassObject
ProgIDFromCLSID
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoUninitialize
oleaut32
GetErrorInfo
DispCallFunc
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
SysFreeString
SysAllocStringLen
SysStringLen
SysAllocString
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
VariantClear
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
crypt32
CertCloseStore
CryptMsgClose
Sections
.text Size: 180KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 16KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mrdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE