Static task
static1
Behavioral task
behavioral1
Sample
ab03c2eaf17924e33115a920f3246980_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
ab03c2eaf17924e33115a920f3246980_JaffaCakes118
-
Size
171KB
-
MD5
ab03c2eaf17924e33115a920f3246980
-
SHA1
937c72f8154be63852e0fd4d98706f96aaa413ee
-
SHA256
86b901459a65329c07323946d661669857f957b7a05eafe5c869d51537303e4b
-
SHA512
0ac8e7f50c7e602c0076fc0f03836f2cdc162295321957aaad6ac7deca153aa57aed17947246e7b4e3349072ae11b7871732f66d3bb641ca21e1aa0154c8b136
-
SSDEEP
3072:jJWYAsJJjGd9wJs63OF37JLt6ndOKIUeuTk9DZoh91emtF8:nPJK2yedOK3h49+h91eWF8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ab03c2eaf17924e33115a920f3246980_JaffaCakes118
Files
-
ab03c2eaf17924e33115a920f3246980_JaffaCakes118.exe windows:4 windows x86 arch:x86
36b3f9a6b1c5a6bf936487bd17689bec
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerInstallFileA
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
GetModuleHandleA
lstrlenA
RemoveDirectoryA
DeleteFileA
GetTempPathA
FindResourceA
SetErrorMode
LeaveCriticalSection
CloseHandle
CreateThread
CreateMutexA
WaitForSingleObject
ReleaseMutex
InterlockedIncrement
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetEvent
InterlockedDecrement
CreateEventA
GetPrivateProfileStringA
OpenEventA
CreateProcessA
GetCurrentThreadId
QueryPerformanceFrequency
CreateFileA
SetFilePointer
GetFileSize
HeapAlloc
GetSystemInfo
HeapCreate
FreeLibrary
GetProcAddress
Sleep
LockResource
GetSystemDefaultLangID
MoveFileA
CreateDirectoryA
FindResourceExA
WriteFile
lstrcpyA
LoadResource
CreateFileMappingA
SizeofResource
WritePrivateProfileStringA
GetShortPathNameA
lstrcmpiA
HeapDestroy
lstrcatA
GetTickCount
GetFileAttributesA
GetTempFileNameA
GetStartupInfoA
ExitProcess
GetCommandLineA
DebugBreak
HeapReAlloc
HeapFree
FindClose
VirtualQuery
VirtualProtect
FindFirstFileA
SearchPathA
GetWindowsDirectoryA
lstrcpynA
ResetEvent
QueryPerformanceCounter
SystemTimeToFileTime
GlobalAlloc
GetCurrentProcess
GetCurrentThread
GetVersion
IsBadReadPtr
GlobalLock
GlobalUnlock
GetVersionExA
CompareStringW
CompareStringA
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
GetLastError
SetLastError
GetModuleFileNameA
UnmapViewOfFile
GlobalFree
MapViewOfFile
LoadLibraryA
ReadFile
lstrcmpA
user32
PostThreadMessageA
CharUpperA
PeekMessageA
MsgWaitForMultipleObjects
GetDesktopWindow
CreateDialogIndirectParamA
LoadStringA
CharNextA
CharLowerBuffA
GetWindowTextA
SetTimer
TranslateMessage
GetMessageA
SetActiveWindow
ShowWindow
EndDialog
SetWindowTextA
GetDlgItem
SendMessageA
SetDlgItemTextA
wsprintfA
LoadIconA
DestroyWindow
SystemParametersInfoA
SetWindowPos
CharLowerA
IsDialogMessageA
ReleaseDC
DispatchMessageA
GetDC
KillTimer
ScreenToClient
MoveWindow
SetWindowRgn
DialogBoxIndirectParamA
GetWindowRect
gdi32
GetObjectA
GetTextExtentPoint32A
LPtoDP
CreateFontIndirectA
DeleteObject
advapi32
RegSetValueExA
OpenThreadToken
OpenProcessToken
GetTokenInformation
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueA
FreeSid
EqualSid
ole32
CoRevokeClassObject
CoCreateInstance
CoCreateGuid
CoRegisterClassObject
CoTaskMemFree
StringFromCLSID
CoReleaseMarshalData
CoInitialize
CoGetInterfaceAndReleaseStream
CoUninitialize
StringFromGUID2
GetRunningObjectTable
CoTaskMemAlloc
CoMarshalInterThreadInterfaceInStream
oleaut32
SysAllocStringLen
SysStringLen
SysFreeString
VariantCopy
VariantClear
SysAllocString
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
Sections
.text Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 106KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE