Static task
static1
Behavioral task
behavioral1
Sample
8a60a5d5744ce60854a4993cbfd6c04c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8a60a5d5744ce60854a4993cbfd6c04c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8a60a5d5744ce60854a4993cbfd6c04c_JaffaCakes118
-
Size
8.3MB
-
MD5
8a60a5d5744ce60854a4993cbfd6c04c
-
SHA1
0eb62420cbd98933bd5fe0a65511e5aea54fd76e
-
SHA256
e101d182c3def8f08a9ab3760abe5620439665dabf8e6f6443c7158a9e411f8f
-
SHA512
e2a285ea70f5d2ea87586f81ed4e225ec6bb4bee477767b2fc17254ddce382f8b0328d25af9a076bc50e25f3997c27e7927ac90315a339ad3b3fdc849980d9ba
-
SSDEEP
196608:/qGewKSJ2HimKqXF3VurDjY58BQxWmrFTLv7EY53qcGcmcDT7qdACR6KIoUmlnrn:z2HimKeurDjY5RxWmrFTLv7EY53qcGcG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8a60a5d5744ce60854a4993cbfd6c04c_JaffaCakes118
Files
-
8a60a5d5744ce60854a4993cbfd6c04c_JaffaCakes118.exe windows:4 windows x86 arch:x86
d0c6554d21026fc1f0a4a47d650e6e65
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetWindowRect
SetWindowLongA
CallWindowProcA
gdiplus
GdipGetImageHeight
GdipDeleteGraphics
GdipLoadImageFromFile
GdipRotateWorldTransform
GdipDisposeImage
GdipGetInterpolationMode
GdipCreateBitmapFromScan0
GdiplusShutdown
GdiplusStartup
GdipGetImagePixelFormat
GdipDrawImageRectRectI
GdipGetImageEncoders
GdipGetImageThumbnail
GdipSaveImageToFile
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipGetImageGraphicsContext
GdipGetImageDimension
GdipDrawImageRect
GdipGetImageWidth
GdipGetImageEncodersSize
ole32
CoCreateInstance
ProgIDFromCLSID
oleaut32
LoadTypeLibEx
kernel32
GetProcAddress
RtlMoveMemory
GetModuleHandleA
LoadLibraryA
FreeLibrary
lstrlenW
GetTickCount
msvbvm60
EVENT_SINK_GetIDsOfNames
ord582
__vbaVarSub
__vbaVarTstGt
ord583
ord690
__vbaStrI2
ord584
__vbaVargParmRef
__vbaNextEachAry
_CIcos
_adj_fptan
ord585
__vbaHresultCheck
__vbaVarMove
__vbaStrI4
__vbaRedimPreserveVar
ord693
__vbaVarVargNofree
ord587
ord694
__vbaAryMove
__vbaFreeVar
__vbaGosubReturn
__vbaLineInputStr
ord588
__vbaLateIdCall
__vbaStrVarMove
__vbaLenBstr
ord696
__vbaEnd
__vbaPut3
__vbaVarIdiv
__vbaFreeVarList
_adj_fdiv_m64
__vbaFpCDblR8
EVENT_SINK_Invoke
__vbaVarIndexStore
__vbaRaiseEvent
__vbaNextEachVar
__vbaFreeObjList
ord516
__vbaVarFix
__vbaVarIndexLoadRef
__vbaStrErrVarCopy
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord518
__vbaVarSetVarAddref
ord626
__vbaCVarAryUdt
ord519
__vbaI2Abs
ord628
__vbaResume
__vbaCopyBytes
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
__vbaWriteFile
__vbaVarTextTstEq
ord553
__vbaBoolErrVar
__vbaLsetFixstr
ord660
__vbaStrDate
__vbaRecDestruct
__vbaSetSystemError
__vbaNameFile
__vbaLenBstrB
ord662
__vbaHresultCheckObj
ord556
ord557
__vbaVargVarCopy
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
ord666
__vbaVarTstLe
ord667
Zombie_GetTypeInfo
__vbaVarXor
__vbaVarCmpGe
__vbaAryDestruct
ord669
ord591
__vbaVarIndexLoadRefLock
__vbaLateMemSt
EVENT_SINK2_Release
ord592
__vbaVarPow
__vbaStrBool
__vbaBoolStr
ord593
__vbaVarForInit
__vbaForEachCollObj
__vbaExitProc
ord300
__vbaI4Abs
ord594
ord301
__vbaStrLike
ord595
__vbaOnError
__vbaObjSet
ord302
ord596
_adj_fdiv_m16i
ord303
ord597
ord702
__vbaObjSetAddref
_adj_fdivr_m16i
ord304
ord598
__vbaVarIndexLoad
ord305
__vbaCyStr
ord704
__vbaFpR4
ord306
__vbaStrFixstr
ord520
ord705
__vbaBoolVar
__vbaForEachCollVar
ord307
ord308
__vbaStrTextCmp
__vbaFPFix
ord309
__vbaVargVar
__vbaRefVarAry
__vbaVarTstLt
__vbaFpR8
__vbaBoolVarNull
_CIsin
ord709
__vbaErase
ord631
__vbaLateMemStAd
ord525
ord632
__vbaVarCmpGt
__vbaVargVarMove
__vbaNextEachCollObj
__vbaVarZero
__vbaChkstk
__vbaGosubFree
__vbaFileClose
ord526
__vbaCyVar
EVENT_SINK_AddRef
ord527
ord528
__vbaVarAbs
__vbaGenerateBoundsError
__vbaGet3
ord529
__vbaExitEachColl
__vbaStrCmp
__vbaPutOwner3
__vbaAryConstruct2
__vbaVarTstEq
__vbaR4Str
__vbaDateR8
ord560
__vbaPrintObj
__vbaVarLikeVar
ord561
__vbaI2I4
__vbaObjVar
__vbaNextEachCollVar
ord562
DllFunctionCall
ord670
ord563
__vbaVarOr
__vbaVarLateMemSt
__vbaFpUI1
__vbaCySub
ord564
__vbaCastObjVar
__vbaStrR4
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaR8Cy
__vbaStrR8
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
ord601
__vbaUI1I2
_CIsqrt
ord310
__vbaLateIdCallSt
__vbaVarAnd
__vbaObjIs
ord311
EVENT_SINK_QueryInterface
__vbaFpCmpCy
__vbaStr2Vec
__vbaUI1I4
ord710
__vbaStrUI1
__vbaVarMul
__vbaExceptHandler
ord312
ord711
ord313
__vbaPrintFile
__vbaStrToUnicode
ord712
ord605
ord314
ord713
__vbaDateStr
__vbaExitEachAry
ord606
_adj_fprem
_adj_fdivr_m64
ord315
__vbaR8ErrVar
__vbaGosub
__vbaLateIdStAd
__vbaUdtVar
__vbaFailedFriend
ord714
__vbaI2Str
__vbaVarDiv
ord607
ord316
ord715
ord608
ord317
__vbaVargVarRef
ord716
ord531
__vbaVarCmpLe
__vbaFPException
ord318
ord532
ord717
__vbaStrCompVar
__vbaInStrVar
ord319
__vbaGetOwner3
__vbaUbound
__vbaStrVarVal
__vbaGetOwner4
__vbaVarCat
ord535
__vbaDateVar
__vbaCheckType
__vbaLsetFixstrFree
ord536
__vbaI2Var
ord644
ord537
__vbaExitEachVar
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord570
__vbaVar2Vec
ord648
__vbaVarLateMemCallLdRf
__vbaR8Str
__vbaInStr
__vbaNew2
__vbaVarInt
ord571
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaStrCopy
EVENT_SINK2_AddRef
ord681
__vbaI4Str
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
ord576
_adj_fdivr_m32
ord577
__vbaPowerR8
__vbaR8Var
_adj_fdiv_r
ord578
ord685
ord100
ord579
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaForEachAry
ord689
__vbaVarCmpEq
ord610
__vbaInStrB
__vbaLateMemCall
__vbaVarAdd
__vbaAryLock
ord320
__vbaFreeVarg
ord612
__vbaStrToAnsi
__vbaStrComp
__vbaVarDup
ord321
ord613
__vbaVerifyVarObj
__vbaAryVarVarg
ord614
__vbaFpI2
__vbaVarMod
__vbaUnkVar
ord616
__vbaVarLateMemCallLd
__vbaVarTstGe
__vbaVarCopy
__vbaFpI4
__vbaVarSetObjAddref
__vbaRecDestructAnsi
ord617
__vbaLateMemCallLd
_CIatan
__vbaUI1Str
__vbaI2ErrVar
ord618
__vbaAryCopy
__vbaCastObj
__vbaStrMove
__vbaR8IntI4
ord619
__vbaForEachVar
__vbaStrVarCopy
__vbaVarNeg
ord542
ord650
_allmul
__vbaVarLateMemCallSt
__vbaLenVarB
__vbaLateIdSt
__vbaAryRecCopy
ord545
__vbaLateMemCallSt
_CItan
__vbaNextEachCollAd
ord546
__vbaUI1Var
__vbaFPInt
__vbaAryUnlock
__vbaFpCSngR8
__vbaVarForNext
_CIexp
ord656
__vbaStrCy
ord580
__vbaRecAssign
__vbaI4ErrVar
__vbaFreeObj
__vbaFreeStr
ord581
Sections
.text Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 232KB - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ