Static task
static1
Behavioral task
behavioral1
Sample
aa409b3c296b8d8718d00c5173e1b410_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
aa409b3c296b8d8718d00c5173e1b410_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
aa409b3c296b8d8718d00c5173e1b410_JaffaCakes118
-
Size
213KB
-
MD5
aa409b3c296b8d8718d00c5173e1b410
-
SHA1
26a9b9998fd97a4d8ed13b5bfb2bea081b4b2213
-
SHA256
427c48a051f2a6225aafa3b1bac7f871f390e229ee02eedd35d9039291d26e11
-
SHA512
1adc611f391ca9ca9dfd731f21e73af04c976c3f2b73ad26f5fafdb1e60b0e82e56659e04cc7e6d2bc9c08af9dca5f05468f1bd12160e59403886288544881e4
-
SSDEEP
6144:tWg4Fp7jdgSdvxtzHtGOy8BTsjWxOCGrZ:k/dgktrtFOrZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa409b3c296b8d8718d00c5173e1b410_JaffaCakes118
Files
-
aa409b3c296b8d8718d00c5173e1b410_JaffaCakes118.exe windows:5 windows x86 arch:x86
ec8c48362c751a178fa0d4bab0946911
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msoeacct
ValidEmailAddress
HrCreateAccountManager
DllCanUnloadNow
DllGetClassObject
GetDllMajorVersion
kernel32
GlobalHandle
GetCurrentProcessId
InterlockedDecrement
GetThreadPriority
WaitForSingleObject
QueryPerformanceCounter
EnterCriticalSection
GetVersionExW
HeapFree
VirtualFree
InterlockedExchange
DeleteCriticalSection
GetCurrentThread
WriteFile
MultiByteToWideChar
lstrlenA
CloseHandle
SetLastError
InterlockedIncrement
GetFullPathNameW
lstrcpyA
GetProfileIntA
GetSystemTimeAsFileTime
GetFileAttributesW
FreeLibrary
GlobalFindAtomW
lstrlenW
GetTickCount
IsValidCodePage
GetLastError
CreateThread
SetEndOfFile
GlobalLock
IsBadWritePtr
IsBadReadPtr
GetSystemInfo
SetThreadPriority
WaitForMultipleObjects
lstrcmpiW
SetFilePointer
lstrcpynW
lstrcpyW
lstrcmpW
GetProcessHeap
InitializeCriticalSection
SetEvent
GlobalAlloc
GlobalFree
WideCharToMultiByte
GetQueuedCompletionStatus
GlobalMemoryStatus
GetFileSize
ReadFile
HeapAlloc
GlobalUnlock
CreateFileW
GetCurrentProcess
CreateSemaphoreW
LeaveCriticalSection
GetModuleFileNameA
LoadLibraryW
GetPrivateProfileStringW
SetUnhandledExceptionFilter
CreateEventW
GetTimeZoneInformation
ResetEvent
ReleaseSemaphore
DeleteFileW
GetDiskFreeSpaceW
MulDiv
GetEnvironmentStringsW
IsBadCodePtr
msnetobj
DllGetClassObject
DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
oleaut32
VarBstrFromDec
VarBstrFromUI8
VarBstrFromDisp
VarBstrFromR4
VarBstrFromR8
VarBstrFromUI4
VarBstrFromI2
VarBstrFromI8
VarBstrFromUI1
VarBstrFromCy
VarBstrFromI4
VarBstrFromDate
VarBstrFromUI2
VarBstrFromI1
user32
GetWindowRect
LoadCursorW
CheckDlgButton
GetDesktopWindow
SetDlgItemInt
GetDlgItemInt
IsRectEmpty
SetDlgItemTextW
GetClientRect
DestroyWindow
DefWindowProcW
LoadStringW
InvalidateRect
IsWindow
CheckRadioButton
GetDC
PeekMessageW
ShowWindow
SetWindowLongW
GetAsyncKeyState
IsWindowVisible
SendMessageW
TranslateMessage
CreateDialogParamW
EnableWindow
ClientToScreen
MoveWindow
SetCursor
ReleaseDC
GetDlgItem
GetWindowLongW
DispatchMessageW
msoert2
AppendTempFileList
msls31
LssbGetVisibleDcpInSubline
LssbGetNumberDnodesInSubline
LssbGetPlsrunsFromSubline
LssbGetDurTrailWithPensInSubline
LsCompressSubline
LssbGetObjDimSubline
msltus40
DllUnregisterServer
DllRegisterServer
cewmdm
DllRegisterServer
DllGetClassObject
DllCanUnloadNow
DllUnregisterServer
nddeapi
NDdeGetShareSecurityW
NDdeIsValidAppTopicListA
NDdeGetErrorStringA
NDdeGetTrustedShareW
NDdeGetTrustedShareA
NDdeIsValidAppTopicListW
Sections
.text Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ