Static task
static1
Behavioral task
behavioral1
Sample
72e1e8d3b857697d4d3fe357497d2102_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
72e1e8d3b857697d4d3fe357497d2102_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
72e1e8d3b857697d4d3fe357497d2102_JaffaCakes118
-
Size
86KB
-
MD5
72e1e8d3b857697d4d3fe357497d2102
-
SHA1
3a0024fafc8e39efc8c03998cd45f9aabe720fdf
-
SHA256
8fb01a8502fd058dca7c5bcea87790346f2dab50bb0707ed86626a420770773a
-
SHA512
dd29efd2266a2a0ed1d4084f0aaa4c1378bd3d03085250c8eb461816bcfbaab7328cca723ef887f1f75675af44d3ebe7bafbb92892311a7c63efb233750f297b
-
SSDEEP
1536:K16horoKM5IzOqu6KgkZnbs1JYkIMlPsmM6JFof:K16r7dbAJYkIOEmM6JFof
Malware Config
Signatures
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule sample Nirsoft -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 72e1e8d3b857697d4d3fe357497d2102_JaffaCakes118
Files
-
72e1e8d3b857697d4d3fe357497d2102_JaffaCakes118.exe windows:4 windows x64 arch:x64
4da5cc46f24a6abf61e1eae48c95d81a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
comctl32
ImageList_Create
ImageList_SetImageCount
ImageList_ReplaceIcon
CreateToolbarEx
ord6
ord17
msvcrt
_acmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
__dllonexit
_strlwr
_itoa
atoi
strcmp
_memicmp
strchr
strrchr
malloc
free
__getmainargs
_initterm
__setusermatherr
modf
memcmp
strtoul
_ultoa
strlen
wcslen
strcpy
??3@YAXPEAX@Z
_purecall
??2@YAPEAX_K@Z
memset
_strcmpi
memcpy
strcat
strncat
sprintf
_commode
_fmode
__set_app_type
kernel32
OpenProcess
GetModuleHandleA
WriteProcessMemory
GetStartupInfoA
FreeLibrary
ReadProcessMemory
GetCurrentProcess
ExitProcess
DeleteFileA
GetPrivateProfileIntA
EnumResourceNamesA
WritePrivateProfileStringA
GetPrivateProfileStringA
lstrlenA
GetModuleFileNameA
WriteFile
GetCurrentProcessId
GlobalUnlock
GetProcAddress
GlobalLock
LoadLibraryA
WideCharToMultiByte
GetLocaleInfoA
GetLastError
LoadLibraryExA
GlobalAlloc
GetTempFileNameA
GetFileAttributesA
GetVersionExA
CloseHandle
ReadFile
GetTempPathA
CreateFileA
GetNumberFormatA
LocalFree
GetFileSize
FormatMessageA
GetWindowsDirectoryA
lstrcpyA
user32
IsDialogMessageA
SetTimer
UpdateWindow
LoadImageA
TranslateMessage
GetMessageA
GetSystemMetrics
GetWindowPlacement
EndDeferWindowPos
PostQuitMessage
TrackPopupMenu
RegisterClassA
SetCapture
KillTimer
CreateWindowExA
GetWindowTextLengthA
TranslateAcceleratorA
EndDialog
SendMessageA
LoadCursorA
GetDlgItem
SetWindowTextA
ChildWindowFromPoint
GetSysColorBrush
SetCursor
SetDlgItemTextA
MessageBoxA
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId
EnumWindows
IsWindowVisible
RegisterWindowMessageA
LoadIconA
EnumChildWindows
SendMessageTimeoutA
GetWindowLongA
SetWindowLongA
SendDlgItemMessageA
GetDlgItemInt
InvalidateRect
SetDlgItemInt
SetFocus
SetClipboardData
EnableWindow
EmptyClipboard
MapWindowPoints
EnableMenuItem
GetClientRect
ReleaseDC
OpenClipboard
GetWindowRect
ScreenToClient
CloseClipboard
GetMenuItemCount
MoveWindow
GetMenuStringA
GetSubMenu
GetMenu
GetCursorPos
CheckMenuItem
GetDC
LoadMenuA
GetParent
ModifyMenuA
LoadStringA
DialogBoxParamA
GetDlgCtrlID
DestroyMenu
CreateDialogParamA
DestroyWindow
GetMenuItemInfoA
SetWindowPos
DestroyIcon
BeginDeferWindowPos
ReleaseCapture
DeferWindowPos
WindowFromPoint
DispatchMessageA
PostMessageA
SetMenu
ShowWindow
LoadAcceleratorsA
GetSysColor
GetFocus
DefWindowProcA
gdi32
PatBlt
SelectObject
GetDeviceCaps
CreateFontIndirectA
SetBkColor
SetBkMode
DeleteObject
SetTextColor
CreateSolidBrush
comdlg32
FindTextA
GetSaveFileNameA
advapi32
RegDeleteKeyA
shell32
ExtractIconExA
ShellExecuteA
ole32
CoUninitialize
CreateStreamOnHGlobal
CoInitialize
GetHGlobalFromStream
oleaut32
SysFreeString
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ