Static task
static1
Behavioral task
behavioral1
Sample
72a0fff85fc7817ff5d3a4bd6741d2ef_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
72a0fff85fc7817ff5d3a4bd6741d2ef_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
72a0fff85fc7817ff5d3a4bd6741d2ef_JaffaCakes118
-
Size
307KB
-
MD5
72a0fff85fc7817ff5d3a4bd6741d2ef
-
SHA1
0d32bc639c99bc32a71bed4739b36df16ef73d4b
-
SHA256
ef397a0c7e08ba802d7825b4181555ed18e9eac7c40594e150a514bc861c2af4
-
SHA512
0fcea20a1afe47a22f3e8d71612c907239b240efb45f0d1a2702a6f7d660f8ca9942473d99bf12b6ddaaa9e6bf94413c4d73f3799f16ba858b34c6dd9c126555
-
SSDEEP
6144:ur0etiKFEI+tI29XKxjp58BKTsQhsOgUPjP7c/7Nm8vf:ur/B++29XKxjp58BKAZU7AtX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 72a0fff85fc7817ff5d3a4bd6741d2ef_JaffaCakes118
Files
-
72a0fff85fc7817ff5d3a4bd6741d2ef_JaffaCakes118.exe windows:5 windows x86 arch:x86
1b94892e37d72e774f6cd347451ccd86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
Imports
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
comctl32
PropertySheetW
setupapi
SetupCloseInfFile
SetupIterateCabinetA
SetupInitDefaultQueueCallbackEx
SetupInstallFromInfSectionA
SetupDefaultQueueCallbackW
SetupCopyErrorA
SetupPromptForDiskA
SetupFindNextLine
SetupGetFieldCount
SetupGetLineTextA
SetupFindFirstLineA
SetupGetStringFieldA
SetupGetLineByIndexA
SetupGetLineCountA
SetupTerminateFileLog
SetupQueryFileLogA
SetupInitializeFileLogA
SetupSetDirectoryIdA
SetupOpenInfFileA
SetupScanFileQueueA
SetupGetIntField
SetupInstallFilesFromInfSectionA
SetupQueueCopyA
SetupGetSourceInfoA
SetupGetSourceFileLocationA
SetupGetTargetPathA
SetupCloseFileQueue
SetupCommitFileQueueA
SetupOpenFileQueue
SetupDecompressOrCopyFileA
SetupDefaultQueueCallbackA
user32
LoadStringW
MessageBoxA
PostQuitMessage
DestroyWindow
SendMessageA
SetDlgItemTextA
ShowWindow
EnableWindow
GetDlgItem
DispatchMessageA
TranslateMessage
GetMessageA
CreateDialogParamA
SetForegroundWindow
PostThreadMessageA
SendDlgItemMessageA
SetWindowTextW
GetWindowTextA
EnumChildWindows
SetWindowLongA
PostMessageA
SetDlgItemTextW
GetWindowLongA
LoadBitmapA
IsDlgButtonChecked
MessageBoxW
CheckDlgButton
ReleaseDC
GetDC
SystemParametersInfoA
SetWindowTextA
EndDialog
DialogBoxParamA
GetDesktopWindow
SetFocus
wvsprintfW
LoadStringA
shlwapi
StrStrIA
ntdll
NtQuerySystemTime
strrchr
_stricmp
RtlUnwind
strncat
_aulldiv
_snprintf
wcscat
vsprintf
memmove
strncmp
RtlUnicodeStringToAnsiString
_strupr
_alldiv
strtoul
strstr
_allmul
memchr
sprintf
RtlTimeToTimeFields
_strnicmp
wcslen
swprintf
wcscpy
_itoa
_strlwr
_strcmpi
strncpy
_chkstk
NtClose
NtAdjustPrivilegesToken
NtOpenProcessToken
NtShutdownSystem
NtQueryInformationProcess
RtlCharToInteger
strchr
mpr
WNetGetUniversalNameA
WNetGetUserA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
ole32
CoInitialize
CoCreateInstance
winspool.drv
GetPrinterDriverDirectoryA
msvcrt
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
isdigit
atoi
strcspn
ctime
__setusermatherr
_tempnam
remove
_lseek
_close
_write
_read
_open
_errno
_wcsdup
_strdup
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
calloc
getenv
malloc
rename
free
advapi32
QueryServiceStatus
EnumDependentServicesA
InitializeAcl
AddAccessAllowedAce
SetFileSecurityA
GetFileSecurityA
GetServiceDisplayNameA
RegOpenKeyA
RegDeleteValueA
OpenSCManagerA
OpenServiceA
StartServiceA
ControlService
CloseServiceHandle
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
FreeSid
RegSetKeySecurity
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSaveKeyA
RegQueryInfoKeyA
SetFileSecurityW
GetAclInformation
AddAce
CopySid
GetLengthSid
SetSecurityInfo
GetSecurityDescriptorDacl
SetSecurityDescriptorControl
GetSecurityInfo
AdjustTokenPrivileges
RegUnLoadKeyA
RegLoadKeyA
OpenProcessToken
DeregisterEventSource
ReportEventA
RegisterEventSourceA
GetTokenInformation
SetNamedSecurityInfoA
GetNamedSecurityInfoA
InitiateSystemShutdownA
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
kernel32
LocalFileTimeToFileTime
SetFileTime
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetModuleHandleA
ExitThread
FormatMessageW
ReadFile
GetTickCount
CreateEventA
CreateThread
SetThreadPriority
WaitForSingleObject
SetEvent
RemoveDirectoryA
EnterCriticalSection
LeaveCriticalSection
DosDateTimeToFileTime
GetFileAttributesExA
SetFilePointer
WriteFile
VirtualFree
DeviceIoControl
GetPrivateProfileStringA
GetDiskFreeSpaceA
SetFileAttributesA
GetSystemDirectoryA
GetModuleFileNameA
VirtualAlloc
InitializeCriticalSection
GetVersionExA
lstrcmpiA
LocalAlloc
LocalFree
CreateFileA
GetFileSize
GetEnvironmentVariableA
CreateMutexA
GetWindowsDirectoryA
GetVolumeInformationW
GetWindowsDirectoryW
CreateFileMappingA
MapViewOfFile
Sleep
GetThreadLocale
GetLocaleInfoA
GetFullPathNameA
GetDriveTypeA
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
MultiByteToWideChar
UnmapViewOfFile
CloseHandle
LoadLibraryA
GetProcAddress
ExpandEnvironmentStringsA
FormatMessageA
SetLastError
GetFileAttributesA
GetLastError
CreateDirectoryA
GetSystemDirectoryW
GetComputerNameA
ReleaseSemaphore
InterlockedDecrement
GetCurrentThread
GetExitCodeThread
SetEndOfFile
CreateSemaphoreA
FlushViewOfFile
GetFileTime
GetExitCodeProcess
CreateProcessA
FlushFileBuffers
MoveFileExA
LoadResource
FindResourceA
MapViewOfFileEx
WideCharToMultiByte
SetEnvironmentVariableA
OpenEventA
WriteProcessMemory
VirtualAllocEx
CreateRemoteThread
OpenProcess
LoadLibraryW
lstrcmpiW
GetDriveTypeW
lstrcpynW
lstrcpyW
SearchPathW
ExpandEnvironmentStringsW
GetVersionExW
GetStartupInfoA
ExitProcess
TerminateThread
SetCurrentDirectoryA
GetSystemInfo
MoveFileA
GetTempFileNameA
lstrlenA
GetTempPathA
GetCurrentProcess
FreeLibrary
GetDiskFreeSpaceExA
CopyFileA
gdi32
CreateCompatibleDC
DeleteObject
GetDeviceCaps
SelectObject
SetLayout
StretchBlt
BitBlt
CreateFontIndirectA
GetDIBits
psapi
GetModuleFileNameExA
Sections
.text Size: 181KB - Virtual size: 181KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 127KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE