Static task
static1
Behavioral task
behavioral1
Sample
769a203326a562cd77a2f5d5af6c1c26_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
769a203326a562cd77a2f5d5af6c1c26_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
769a203326a562cd77a2f5d5af6c1c26_JaffaCakes118
-
Size
89KB
-
MD5
769a203326a562cd77a2f5d5af6c1c26
-
SHA1
dae4ad83cd2e6d6366b56e103ae694af890b140a
-
SHA256
a28317078dc64f1a2ce49c8a60bb419da825b3ebf450eb4641c82d427e51bc9a
-
SHA512
76734b7387c3929d2a3829b81dfa3a1236c56c73bfb01fb1ef1daf8d53027cb19354ba9c0a1627d193a6ee242cd77bcf849d475a97e402f74b8b9a27ada440d1
-
SSDEEP
1536:8JoCTE1r5lBYfqf3P62O00a5HsTTx2ORFK7ULAD5:wZY1r5Mfihv5Ha2ORFGULY5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 769a203326a562cd77a2f5d5af6c1c26_JaffaCakes118
Files
-
769a203326a562cd77a2f5d5af6c1c26_JaffaCakes118.exe windows:5 windows x86 arch:x86
a19234b6ae0ec38914acebf111d4c344
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gamevancelib32
?GetExcludedUrlsSeq@@YGKPAD@Z
GetUuid
?HostToIP@@YGHPAD0K@Z
?Base64EncodeFunc@@YGHPAD0H@Z
?CanCheckPopup@@YGHPAU_TSharedStruct@@PAU_tagPopupInfo@@@Z
?GetWindowsProductId@@YGHPADK@Z
?GetDefaultCfgServer@@YGHPADK0@Z
?IsWindowsVista@@YAHXZ
?GetGeoIPCountryCode@@YGHPADH0@Z
?SetLastPopupTimeNT@@YGHU_FILETIME@@PAD@Z
?string_table_delete_all@@YGHPAUst_string_table@@@Z
?SetExcludedUrlsSeq@@YGHKPAD@Z
?SetPopupCountNT@@YGHKPAD@Z
SetAdLocation
?ParsePopupData@@YGHPADPAU_tagPopupData@@@Z
?SetCheckPopServer@@YGHPAD0@Z
?SetClientId@@YGHPAD0@Z
?SaveQoolPopups_T@@YGHPAU_tagQoolPopup@@PAD@Z
?SetLastPopupTimeT@@YGHU_FILETIME@@PAD@Z
?SaveQoolPopups_NT@@YGHPAU_tagQoolPopup@@PAD@Z
?SetPopupInProgress@@YGHH@Z
?SetPopupCountT@@YGHKPAD@Z
?SetGeoIPCountryCode@@YGHPAD0@Z
?ShowPopupInDefaultBrowser@@YGHKPAU_tagPopupData@@@Z
?ShowPopupInDefaultBrowser2@@YGHKPAU_tagPopupData@@@Z
?AddFiredPid@@YGHPAPAU_tagQoolPopup@@HH@Z
?xml_parse_config@@YGHPADPAPAU_tagCONFIG_STRUCT@@PAHPAUst_string_table@@@Z
?SetPopupsStatusDisabled@@YGHKPAD@Z
?string_table_add@@YGHPAUst_string_table@@PAD@Z
?SetDefaultCfgServer@@YGHPAD0@Z
?GetLastPopupTimeNT@@YG?AU_FILETIME@@PAD@Z
?GetLastPopupTimeT@@YG?AU_FILETIME@@PAD@Z
?RemoveOldPopups@@YGHPAPAU_tagQoolPopup@@@Z
?IsPopupInProgress@@YGHXZ
?GetClientId@@YGHPADK0@Z
?DeleteRecoveryModule@@YAXXZ
?GetUniqueClientId@@YGHPADK@Z
GetAdLocation
?GetClientInstallDate@@YG?AU_FILETIME@@XZ
?FindBrowserWindow@@YGPAUHWND__@@K@Z
?IsPopupEngineDisabled@@YGHXZ
?IsHeaderFirstRun@@YGHXZ
?GetCfgFilePath@@YGHPADH@Z
?LoadFiredPopups_T@@YGHPAPAU_tagQoolPopup@@PAD@Z
?GetOSVersionString@@YGHPADK@Z
?string_table_alloc@@YGHPAPAUst_string_table@@@Z
?IsWindowsMe@@YGHXZ
?GetWS2SendFrame@@YGHPADK@Z
?GetIEVersion@@YGXPADK@Z
?ScheduleFileUpdate@@YGXPAD0@Z
?FileTimeSecondsBetween@@YG_JU_FILETIME@@0@Z
?GetHardwareHashCrcHex@@YGHPADH@Z
?GetPopupCountT@@YGKPAD@Z
?GetCrc64@@YGHPADK0@Z
?ParsePacketContent@@YGHPAU_tagHttpData@@PAUHWND__@@PAUst_string_table@@2PAPAU_tagQoolPopup@@3H@Z
?ModuleFromAddress@@YGPAUHINSTANCE__@@PAX@Z
?LoadFiredPopups_NT@@YGHPAPAU_tagQoolPopup@@PAD@Z
?SetClientInstallDate@@YGXU_FILETIME@@@Z
?GetPopupCountNT@@YGKPAD@Z
?GetCheckPopServer@@YGHPADK0@Z
?SetCrc64@@YGHPAD0@Z
shlwapi
StrNCatA
StrStrA
wnsprintfA
StrStrIA
kernel32
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetLocaleInfoA
HeapSize
RtlUnwind
VirtualAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LeaveCriticalSection
QueryPerformanceCounter
VirtualFree
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
GetModuleHandleW
GetStartupInfoA
GetCommandLineA
EnterCriticalSection
IsBadReadPtr
ReleaseMutex
OpenMutexA
ExitProcess
lstrlenA
MapViewOfFile
lstrcpynA
HeapAlloc
SetUnhandledExceptionFilter
SystemTimeToFileTime
HeapFree
GetTickCount
GetProcessHeap
GetSystemTimeAsFileTime
Sleep
CreateProcessA
IsBadWritePtr
GetLastError
GetProcAddress
GetLocalTime
LoadLibraryA
CreateFileMappingA
GetModuleFileNameA
CreateMutexA
CloseHandle
GetCurrentProcessId
LocalFree
lstrcpyA
lstrcatA
HeapReAlloc
VirtualQuery
WriteFile
HeapDestroy
HeapCreate
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObject
user32
GetLastInputInfo
DefWindowProcA
CreateWindowExA
TranslateMessage
SendMessageA
ShowWindow
PostQuitMessage
RegisterClassExA
SetTimer
GetMessageA
DestroyWindow
RegisterWindowMessageA
PostMessageA
DispatchMessageA
FindWindowA
KillTimer
advapi32
SetNamedSecurityInfoA
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegCloseKey
RegDeleteValueA
ole32
CoInitialize
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ