Static task
static1
Behavioral task
behavioral1
Sample
70dbed4a06889491a32de5e853c3f462_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
70dbed4a06889491a32de5e853c3f462_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
70dbed4a06889491a32de5e853c3f462_JaffaCakes118
-
Size
6.5MB
-
MD5
70dbed4a06889491a32de5e853c3f462
-
SHA1
1ce39cab501cfa32fdbe562f2ae88665555eded1
-
SHA256
318348f3da0db0387b642b749ef3100bda4b4e7f08013add8d62818ae2e60198
-
SHA512
ef219cdffa48dfcdf1c2fd2904688f06b4b98e362680b0852099d3c30df76b0e6c55548598832e33ddc493b5068badac6bc929475811846bd35a6c1db22b9924
-
SSDEEP
98304:6Hy1F5KuwXBophvCAkHrBpCTTOHYpT4J47MnHsUe4qeQWN9Toi+mq8xK1z5mBtLd:6HyF5VhDuVpCXyYpgHa0QmToi+icXdpq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70dbed4a06889491a32de5e853c3f462_JaffaCakes118
Files
-
70dbed4a06889491a32de5e853c3f462_JaffaCakes118.exe windows:4 windows x86 arch:x86
eb7062cc0d2e7d9bb3906c249be2fba8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTapeStatus
WritePrivateProfileStructA
SetFileAttributesA
SetNamedPipeHandleState
EnumResourceNamesA
PrepareTape
SetErrorMode
ExitProcess
lstrcmpA
GlobalUnlock
SetProcessAffinityMask
CompareStringW
DuplicateHandle
IsBadReadPtr
GetDriveTypeA
MoveFileW
LocalFileTimeToFileTime
lstrcatW
GetDiskFreeSpaceW
DebugBreak
FillConsoleOutputCharacterA
ExpandEnvironmentStringsW
OpenFile
SetMailslotInfo
LoadLibraryExA
GetOEMCP
GetSystemInfo
SetLastError
GetPrivateProfileStringA
GetVersion
user32
RegisterWindowMessageW
UnhookWindowsHook
DrawFocusRect
GetClassInfoW
MsgWaitForMultipleObjectsEx
FlashWindow
GetClassInfoExW
GetUserObjectSecurity
TileWindows
GetWindowTextLengthW
GetMenu
CreateDialogIndirectParamW
SetPropA
GetMessageA
CharLowerA
DrawTextExA
DialogBoxParamW
DefWindowProcW
OemToCharBuffA
EqualRect
GetWindowDC
EnumThreadWindows
GetShellWindow
CallNextHookEx
LoadBitmapW
MessageBoxW
MapVirtualKeyA
SetPropW
SystemParametersInfoW
PostMessageA
CreateDesktopW
EndDeferWindowPos
CreateDialogParamA
SwapMouseButton
CreateAcceleratorTableA
InvertRect
GetClipboardViewer
GetWindowRgn
OemToCharA
GetDCEx
ValidateRect
CheckMenuItem
LoadKeyboardLayoutA
CharLowerW
SetWindowContextHelpId
GetDialogBaseUnits
LoadIconW
SetWindowPlacement
GetNextDlgGroupItem
MessageBoxIndirectW
IsZoomed
ToUnicodeEx
PtInRect
LoadStringA
GetMenuInfo
gdi32
DeleteMetaFile
CreateBitmap
EnumFontFamiliesExW
EnumFontsW
GetROP2
CreateSolidBrush
Chord
SelectClipRgn
PlayEnhMetaFile
FillRgn
GetTextCharsetInfo
Polygon
SwapBuffers
GetRgnBox
ExtCreatePen
advapi32
AllocateLocallyUniqueId
CryptGetUserKey
AbortSystemShutdownA
ChangeServiceConfigA
ObjectDeleteAuditAlarmW
IsTextUnicode
RegRestoreKeyW
NotifyBootConfigStatus
RevertToSelf
GetSidLengthRequired
GetFileSecurityW
CryptSetKeyParam
OpenServiceA
GetNamedSecurityInfoA
EnumDependentServicesA
ObjectCloseAuditAlarmA
QueryServiceStatus
SetKernelObjectSecurity
GetFileSecurityA
LookupAccountNameA
CryptSetProvParam
CreateProcessAsUserW
RegOpenKeyW
IsValidSid
OpenSCManagerA
AccessCheckAndAuditAlarmA
LockServiceDatabase
ImpersonateLoggedOnUser
RegCreateKeyW
CryptGetHashParam
CreateServiceW
PrivilegeCheck
ImpersonateSelf
GetLengthSid
shell32
SHLoadInProc
FindExecutableW
SHAddToRecentDocs
FindExecutableA
SHGetDesktopFolder
ShellExecuteA
SHGetSpecialFolderPathA
SHChangeNotify
DragQueryPoint
ole32
OleSetContainedObject
StgCreateStorageEx
CoGetInterfaceAndReleaseStream
OleCreateMenuDescriptor
WriteClassStg
GetClassFile
CreateStreamOnHGlobal
CLSIDFromString
CreateBindCtx
oleaut32
SafeArrayPutElement
comctl32
ImageList_LoadImageA
ImageList_GetDragImage
shlwapi
SHOpenRegStream2W
PathIsUNCServerW
msvcrt
strstr
_beginthreadex
isspace
signal
localtime
_stat
isleadbyte
_sys_errlist
atol
_mbsinc
_wtoi64
swscanf
strncmp
iswxdigit
putchar
_vsnprintf
wcscpy
_endthreadex
_access
_mbsupr
setvbuf
strncat
swprintf
_chdrive
_ui64tow
_sopen
wcsftime
fgetws
_chdir
_fstat
_wcsupr
_dup
_ultow
memmove
iswctype
strcoll
_wcsicmp
_mbsnbicmp
strspn
strncpy
wcslen
iswdigit
iswalpha
_ismbblead
calloc
_wstrtime
_wpopen
_wspawnv
_sleep
fwrite
_finite
_ismbcspace
_chsize
Sections
.text Size: 4KB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ