Static task
static1
Behavioral task
behavioral1
Sample
a76f83411ceaa190f7590996d552247c_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a76f83411ceaa190f7590996d552247c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a76f83411ceaa190f7590996d552247c_JaffaCakes118
-
Size
265KB
-
MD5
a76f83411ceaa190f7590996d552247c
-
SHA1
1f5ed27b9d3a00a2129f69aa48ae72871e6e6907
-
SHA256
e42610a45715b3ade2e5cde74adadbf8b73130da67de4b634db29f6fc76f143a
-
SHA512
3d12334a55d95c8a016f844221e8dc6501bd90035f4bfb5a94be310bdee8af8a13c61f122daa4880f740177f14e9baf7df6d4d0829c228988304eb145760c31e
-
SSDEEP
3072:TosSZ8cxcv7TmWaeXmCpjbZBVZA9jEeagikl3LPh5a94aITNAk0BxuIySl0u1zLY:lWVcvnme2CpLAxEeaJ63DHa+3mLUhzb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a76f83411ceaa190f7590996d552247c_JaffaCakes118
Files
-
a76f83411ceaa190f7590996d552247c_JaffaCakes118.exe windows:6 windows x86 arch:x86
862ab366fd1a263098a63e8f65be7d83
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_wcsicmp
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
_makepath
_wmakepath
wcscmp
wcscpy
_wcslwr
wcschr
malloc
free
puts
memmove
fprintf
_wsplitpath
_splitpath
fopen
vfprintf
fclose
sprintf
vswprintf
swprintf
wcslen
wcscat
strstr
vsprintf
__CxxFrameHandler
_wstati64
_stati64
_purecall
_ftol
??3@YAXPAX@Z
??2@YAPAXI@Z
toupper
atol
strtok
strncmp
strncpy
strncat
_stricmp
_strnicmp
kernel32
VirtualFree
VirtualAlloc
DeviceIoControl
IsBadWritePtr
ResetEvent
QueryDosDeviceA
GetVersionExA
CreateFileA
WideCharToMultiByte
CreateFileW
OutputDebugStringA
OutputDebugStringW
MultiByteToWideChar
FindFirstFileA
FindFirstFileW
GetTempFileNameA
GetTempFileNameW
DeleteFileA
DeleteFileW
CreateDirectoryA
CreateDirectoryW
CloseHandle
ReadFile
SetEndOfFile
WriteFile
SetFilePointer
GetLastError
GetTempPathW
CreateMutexA
InterlockedDecrement
GetCurrentThread
GetCurrentThreadId
lstrcmpiA
GetCommandLineA
GetModuleFileNameA
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
InterlockedIncrement
GetShortPathNameA
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpyA
lstrcatA
GetCurrentProcess
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
GetDriveTypeW
GetDriveTypeA
CreateThread
SearchPathA
SetEvent
GetFileSize
GetVolumeInformationA
GetStartupInfoA
CreateEventA
user32
DispatchMessageA
MessageBoxA
GetMessageA
LoadStringA
CharNextA
MessageBoxW
wsprintfA
PostThreadMessageA
advapi32
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetLengthSid
CopySid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ControlService
DeleteService
CreateServiceA
StartServiceCtrlDispatcherA
OpenThreadToken
SetServiceStatus
RegisterServiceCtrlHandlerA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
OpenSCManagerA
OpenServiceA
CloseServiceHandle
RegDeleteValueA
RegDeleteValueW
RegEnumKeyExA
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegCloseKey
RegEnumKeyW
RegEnumKeyA
RegDeleteKeyW
RegDeleteKeyA
RegSetValueExW
RegSetValueExA
RegCreateKeyExW
RegCreateKeyExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
shell32
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
ole32
CoUninitialize
CoRevokeClassObject
CoInitializeSecurity
CoInitialize
CoCreateInstance
CoRegisterClassObject
CoDisconnectObject
oleaut32
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysFreeString
SysAllocString
RegisterTypeLi
shlwapi
PathFileExistsA
PathFileExistsW
winmm
timeGetTime
Sections
.text Size: 204KB - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ