Static task
static1
Behavioral task
behavioral1
Sample
8402a938b7de3cd7bd8043bf97baa67c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8402a938b7de3cd7bd8043bf97baa67c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8402a938b7de3cd7bd8043bf97baa67c_JaffaCakes118
-
Size
89KB
-
MD5
8402a938b7de3cd7bd8043bf97baa67c
-
SHA1
ce0d5e3fbfc800d01cde75ec518b991343c428af
-
SHA256
fab27341f387a14f5f25fa24ca0e00930c6a1c88374b759ebc5c303c03ba9aa1
-
SHA512
e32d3c7bc33e57ec66128349590a7f7b45ff7c92562653b342121a0d70d14d8816d1b09eb0b77d307ac8dee5931379cd03ead12839bbc28ade74d6f32e74731b
-
SSDEEP
1536:4JoCTE1r5lBYfqf3P62E80a5HeTTx2ORFK7ULAD5:0ZY1r5MfiTv5Hk2ORFGULY5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8402a938b7de3cd7bd8043bf97baa67c_JaffaCakes118
Files
-
8402a938b7de3cd7bd8043bf97baa67c_JaffaCakes118.exe windows:5 windows x86 arch:x86
a19234b6ae0ec38914acebf111d4c344
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gamevancelib32
?GetExcludedUrlsSeq@@YGKPAD@Z
GetUuid
?HostToIP@@YGHPAD0K@Z
?Base64EncodeFunc@@YGHPAD0H@Z
?CanCheckPopup@@YGHPAU_TSharedStruct@@PAU_tagPopupInfo@@@Z
?GetWindowsProductId@@YGHPADK@Z
?GetDefaultCfgServer@@YGHPADK0@Z
?IsWindowsVista@@YAHXZ
?GetGeoIPCountryCode@@YGHPADH0@Z
?SetLastPopupTimeNT@@YGHU_FILETIME@@PAD@Z
?string_table_delete_all@@YGHPAUst_string_table@@@Z
?SetExcludedUrlsSeq@@YGHKPAD@Z
?SetPopupCountNT@@YGHKPAD@Z
SetAdLocation
?ParsePopupData@@YGHPADPAU_tagPopupData@@@Z
?SetCheckPopServer@@YGHPAD0@Z
?SetClientId@@YGHPAD0@Z
?SaveQoolPopups_T@@YGHPAU_tagQoolPopup@@PAD@Z
?SetLastPopupTimeT@@YGHU_FILETIME@@PAD@Z
?SaveQoolPopups_NT@@YGHPAU_tagQoolPopup@@PAD@Z
?SetPopupInProgress@@YGHH@Z
?SetPopupCountT@@YGHKPAD@Z
?SetGeoIPCountryCode@@YGHPAD0@Z
?ShowPopupInDefaultBrowser@@YGHKPAU_tagPopupData@@@Z
?ShowPopupInDefaultBrowser2@@YGHKPAU_tagPopupData@@@Z
?AddFiredPid@@YGHPAPAU_tagQoolPopup@@HH@Z
?xml_parse_config@@YGHPADPAPAU_tagCONFIG_STRUCT@@PAHPAUst_string_table@@@Z
?SetPopupsStatusDisabled@@YGHKPAD@Z
?string_table_add@@YGHPAUst_string_table@@PAD@Z
?SetDefaultCfgServer@@YGHPAD0@Z
?GetLastPopupTimeNT@@YG?AU_FILETIME@@PAD@Z
?GetLastPopupTimeT@@YG?AU_FILETIME@@PAD@Z
?RemoveOldPopups@@YGHPAPAU_tagQoolPopup@@@Z
?IsPopupInProgress@@YGHXZ
?GetClientId@@YGHPADK0@Z
?DeleteRecoveryModule@@YAXXZ
?GetUniqueClientId@@YGHPADK@Z
GetAdLocation
?GetClientInstallDate@@YG?AU_FILETIME@@XZ
?FindBrowserWindow@@YGPAUHWND__@@K@Z
?IsPopupEngineDisabled@@YGHXZ
?IsHeaderFirstRun@@YGHXZ
?GetCfgFilePath@@YGHPADH@Z
?LoadFiredPopups_T@@YGHPAPAU_tagQoolPopup@@PAD@Z
?GetOSVersionString@@YGHPADK@Z
?string_table_alloc@@YGHPAPAUst_string_table@@@Z
?IsWindowsMe@@YGHXZ
?GetWS2SendFrame@@YGHPADK@Z
?GetIEVersion@@YGXPADK@Z
?ScheduleFileUpdate@@YGXPAD0@Z
?FileTimeSecondsBetween@@YG_JU_FILETIME@@0@Z
?GetHardwareHashCrcHex@@YGHPADH@Z
?GetPopupCountT@@YGKPAD@Z
?GetCrc64@@YGHPADK0@Z
?ParsePacketContent@@YGHPAU_tagHttpData@@PAUHWND__@@PAUst_string_table@@2PAPAU_tagQoolPopup@@3H@Z
?ModuleFromAddress@@YGPAUHINSTANCE__@@PAX@Z
?LoadFiredPopups_NT@@YGHPAPAU_tagQoolPopup@@PAD@Z
?SetClientInstallDate@@YGXU_FILETIME@@@Z
?GetPopupCountNT@@YGKPAD@Z
?GetCheckPopServer@@YGHPADK0@Z
?SetCrc64@@YGHPAD0@Z
shlwapi
StrNCatA
StrStrA
wnsprintfA
StrStrIA
kernel32
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetLocaleInfoA
HeapSize
RtlUnwind
VirtualAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LeaveCriticalSection
QueryPerformanceCounter
VirtualFree
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
GetModuleHandleW
GetStartupInfoA
GetCommandLineA
EnterCriticalSection
IsBadReadPtr
ReleaseMutex
OpenMutexA
ExitProcess
lstrlenA
MapViewOfFile
lstrcpynA
HeapAlloc
SetUnhandledExceptionFilter
SystemTimeToFileTime
HeapFree
GetTickCount
GetProcessHeap
GetSystemTimeAsFileTime
Sleep
CreateProcessA
IsBadWritePtr
GetLastError
GetProcAddress
GetLocalTime
LoadLibraryA
CreateFileMappingA
GetModuleFileNameA
CreateMutexA
CloseHandle
GetCurrentProcessId
LocalFree
lstrcpyA
lstrcatA
HeapReAlloc
VirtualQuery
WriteFile
HeapDestroy
HeapCreate
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObject
user32
GetLastInputInfo
DefWindowProcA
CreateWindowExA
TranslateMessage
SendMessageA
ShowWindow
PostQuitMessage
RegisterClassExA
SetTimer
GetMessageA
DestroyWindow
RegisterWindowMessageA
PostMessageA
DispatchMessageA
FindWindowA
KillTimer
advapi32
SetNamedSecurityInfoA
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegCloseKey
RegDeleteValueA
ole32
CoInitialize
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ