wscript.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ab4ae2ded7f530b1867a8c61a9701883_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ab4ae2ded7f530b1867a8c61a9701883_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ab4ae2ded7f530b1867a8c61a9701883_JaffaCakes118
-
Size
116KB
-
MD5
ab4ae2ded7f530b1867a8c61a9701883
-
SHA1
2c15c5e60fa3e68906a80f3dd0577f66919387e6
-
SHA256
c906406ac0c7a23ba6f5d8f99f16167a9049d68e948c8714aa452c5c76776a29
-
SHA512
e7059d1f781923bd40232d81d115c22e51258cdf9809775cf63a7ffe08d7d72cf0f1a42d1919a8fec45f356db701f4d25cb9757404e9f0efeea9ee7d7efd73ba
-
SSDEEP
1536:m4l//ddoIoWQ4kFnV2Op7ZVmPOKK4LZZAnyARcKItw0DJyICF46Oiq/WcD+Yjd:pox46Vdp9V4LZZAyARl0DJyIu4liPc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ab4ae2ded7f530b1867a8c61a9701883_JaffaCakes118
Files
-
ab4ae2ded7f530b1867a8c61a9701883_JaffaCakes118.exe windows:5 windows x86 arch:x86
f477390aaf332ebe38831742e35e40e9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_vsnprintf
_beginthread
??2@YAPAXI@Z
_endthread
sprintf
_except_handler3
wcsrchr
_itow
_ftol
free
malloc
??3@YAXPAX@Z
advapi32
RegOpenKeyExA
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegCreateKeyExW
RegCreateKeyExA
RegOpenKeyExW
RegCreateKeyA
RegCloseKey
RegSetValueA
RegOpenKeyA
RegQueryValueA
RegDeleteKeyA
ImpersonateLoggedOnUser
RegisterEventSourceW
GetUserNameW
LookupAccountNameW
ReportEventW
DeregisterEventSource
IsTextUnicode
RegSetValueExW
kernel32
GetStartupInfoA
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
GetCommandLineA
lstrlenW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetPrivateProfileIntA
GetPrivateProfileStringW
GetPrivateProfileStringA
GetFullPathNameW
GetFullPathNameA
GetModuleHandleA
lstrlenA
lstrcpyA
HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree
GetStdHandle
GetFileType
FreeLibrary
GetSystemDirectoryA
GetTempPathA
GetTempFileNameA
CreateFileA
WriteFile
FlushFileBuffers
GetUserDefaultLCID
GetCPInfo
GetFileAttributesW
FindFirstFileW
GetFileAttributesA
FindFirstFileA
FindClose
GetLastError
ExitProcess
GetACP
CreateEventA
CreateThread
CloseHandle
SetEvent
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
GetCurrentThreadId
GetVersionExA
GetPrivateProfileIntW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileW
GetLocaleInfoA
GetModuleFileNameW
LoadLibraryA
LocalFree
FormatMessageA
LocalAlloc
FormatMessageW
GetProcAddress
user32
SetWindowLongA
GetWindowLongA
CreateWindowExA
RegisterClassA
GetClassInfoA
CharNextA
LoadStringA
LoadStringW
SetTimer
GetMessageA
DispatchMessageA
GetActiveWindow
MessageBoxW
PostThreadMessageA
DefWindowProcA
PostQuitMessage
KillTimer
EnumThreadWindows
IsWindowVisible
PostMessageA
wsprintfA
wsprintfW
GetParent
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects
SendMessageA
oleaut32
VariantCopy
VariantClear
CreateErrorInfo
SetErrorInfo
SysAllocStringByteLen
SysFreeString
LoadRegTypeLi
SysAllocStringLen
SysStringLen
LoadTypeLibEx
UnRegisterTypeLi
SafeArrayGetLBound
SafeArrayCopy
VariantInit
LoadTypeLi
VariantChangeType
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SysAllocString
ole32
CoGetMalloc
StringFromCLSID
CoRegisterClassObject
CoRevokeClassObject
CoCreateInstance
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CreateBindCtx
CreateFileMoniker
CoInitializeSecurity
CoRegisterMessageFilter
CLSIDFromString
CLSIDFromProgID
MkParseDisplayName
CoGetClassObject
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
imm32
ImmGetDefaultIMEWnd
Sections
.text Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 41KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE