setup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
899ff06b021df0071ea383837e1bffef_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
899ff06b021df0071ea383837e1bffef_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
899ff06b021df0071ea383837e1bffef_JaffaCakes118
-
Size
438KB
-
MD5
899ff06b021df0071ea383837e1bffef
-
SHA1
ba08f379a8e5eae60b496fd8e7b7465397d7d6e3
-
SHA256
18ce75d05359acb810b69c560cee3108b6a11d78e4dfc94f7251f34597fb5f17
-
SHA512
ee5bbf2c4c2eb7af1d8c9b9040c50e344cccde2e1ab7cc304fd430f3a18b05a15daf796012b88fb868de3ab7acaee0956cb640ad5b32303f6b1314cc7ee61066
-
SSDEEP
12288:Bo9AU0J0uXKqkmk32gTeoSpQlfqJgGy3Sab:Bo9W0uXKqkmy3THI8qi3SU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 899ff06b021df0071ea383837e1bffef_JaffaCakes118
Files
-
899ff06b021df0071ea383837e1bffef_JaffaCakes118.exe windows:4 windows x86 arch:x86
65563a50476915a5464c522cd0dbbeb7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CompareStringW
GetCommandLineW
HeapSize
SetFileAttributesW
FindNextFileW
RemoveDirectoryW
DeleteFileW
GetTempFileNameW
GetFileAttributesW
FindResourceExA
LoadResource
SizeofResource
LockResource
GlobalAlloc
LoadLibraryW
CreateDirectoryW
GetUserDefaultUILanguage
GetTempPathW
GetTempPathA
MoveFileExW
CreateFileW
ReadFile
FindFirstFileW
FindClose
GetFileSizeEx
ExpandEnvironmentStringsW
GetFullPathNameW
lstrcmpW
GetSystemTime
SystemTimeToTzSpecificLocalTime
lstrlenW
SetEnvironmentVariableA
GetLastError
FormatMessageW
GlobalFree
LocalFree
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
FatalAppExitA
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetModuleHandleA
ExitProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
HeapValidate
IsBadReadPtr
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
HeapDestroy
HeapCreate
VirtualFree
WriteFile
RaiseException
DebugBreak
IsDebuggerPresent
MultiByteToWideChar
lstrlenA
LoadLibraryA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GetModuleFileNameW
GetACP
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
InitializeCriticalSection
HeapReAlloc
VirtualAlloc
RtlUnwind
VirtualQuery
SetFilePointer
GetConsoleCP
GetConsoleMode
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetLocaleInfoW
GetTimeFormatA
GetDateFormatA
IsValidLocale
IsValidCodePage
EnumSystemLocalesA
GetUserDefaultLCID
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
GetTimeZoneInformation
CreateFileA
CloseHandle
FlushFileBuffers
CompareStringA
ole32
StringFromGUID2
user32
LoadStringW
MessageBoxA
MessageBoxExW
MessageBoxW
EnableWindow
GetDlgItem
IsDlgButtonChecked
SetDlgItemTextW
SetWindowTextW
SetDlgItemTextA
EndDialog
DialogBoxParamW
comctl32
ord17
msi
ord169
ord141
ord70
ord88
ord19
ord92
ord190
ord16
ord8
ord20
ord137
shell32
CommandLineToArgvW
SHGetFolderPathW
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
Sections
.text Size: 316KB - Virtual size: 314KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16.1MB - Virtual size: 16.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ