Static task
static1
Behavioral task
behavioral1
Sample
af926f6383634719883d88fadc990090_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
af926f6383634719883d88fadc990090_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
af926f6383634719883d88fadc990090_JaffaCakes118
-
Size
224KB
-
MD5
af926f6383634719883d88fadc990090
-
SHA1
552cfa4d47ab81da674222a77bf1a73594c31f07
-
SHA256
38e2b408de3a65c2b5f29a61dfe961f010ae9bbd9fdb3c2d1ff82bca1cdb1abd
-
SHA512
ba2c295f96e3fa3b38e4f8f4923961441cf58b26972a6b644ed184ed32569920b37320f5b7b58efb004222a74dd3ef68ebcbca1860b908f52cd8c5a8b99333d1
-
SSDEEP
3072:hCp+Kyc5L8NP6WVHo1AS7VTtf0f0c1KHKSWA/7xm5p3dtOHoS57I9zpcIyBBBBBu:H5NIaSJl08lHKAjxmDNEHo8KNV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af926f6383634719883d88fadc990090_JaffaCakes118
Files
-
af926f6383634719883d88fadc990090_JaffaCakes118.exe windows:4 windows x86 arch:x86
024f14b36a13dec21b1f5cdf93518cf9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFilePointer
WriteFile
LocalFree
FormatMessageA
CreateEventA
OutputDebugStringA
CloseHandle
WaitForSingleObject
SetEvent
InterlockedIncrement
GetVolumeInformationA
lstrcmpiA
GetFileAttributesA
MoveFileA
DeleteFileA
ResumeThread
GetLocaleInfoA
GetSystemTime
InterlockedDecrement
GetStartupInfoA
lstrlenA
GetModuleFileNameA
lstrcmpA
lstrcatA
lstrcpyA
CreateThread
GetDriveTypeA
HeapDestroy
CreateFileA
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
GetFileSize
ReadFile
EnterCriticalSection
FileTimeToSystemTime
CreateDirectoryA
LoadLibraryA
LeaveCriticalSection
GetVersionExA
IsDBCSLeadByte
GetProcAddress
InitializeCriticalSection
GetLastError
lstrcpynA
LoadLibraryExA
SizeofResource
FindResourceA
LoadResource
GetShortPathNameA
FreeLibrary
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
Sleep
GetCommandLineA
GetCurrentThreadId
DeleteCriticalSection
GetFullPathNameA
user32
IsIconic
GetSystemMetrics
GetMessageA
DispatchMessageA
KillTimer
CharNextA
SetDlgItemInt
SetFocus
EnableWindow
DialogBoxParamA
ScreenToClient
LoadMenuA
GetSubMenu
DeleteMenu
TrackPopupMenu
DestroyMenu
LoadIconA
LoadImageA
SendDlgItemMessageA
CreateWindowExA
GetDesktopWindow
IsWindow
GetParent
MessageBoxA
GetMenuItemID
GetMenuItemCount
GetWindowTextA
GetWindowLongA
SetWindowLongA
PostMessageA
GetWindowRect
SetWindowPos
UpdateWindow
LoadCursorA
SetCursor
GetDlgItem
ShowWindow
SetDlgItemTextA
SendMessageA
wsprintfA
EndDialog
DestroyIcon
PostThreadMessageA
LoadStringA
SetTimer
advapi32
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
shfolder
SHGetFolderPathA
shell32
SHGetFileInfoA
SHBrowseForFolderA
SHGetPathFromIDListA
ole32
CoInitialize
CoTaskMemAlloc
CoUninitialize
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemRealloc
CoDisconnectObject
CoTaskMemFree
CoCreateInstance
oleaut32
SysAllocString
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
VariantClear
comctl32
ImageList_Destroy
ImageList_SetOverlayImage
ImageList_ReplaceIcon
ImageList_Create
mpr
WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum
extdb
?DeleteFileEntry@CExtendedDB@@QAEHPAD@Z
?CopyFolder@CExtendedDB@@QAEHPAD0@Z
?CopyFileEntry@CExtendedDB@@QAEHPAD000@Z
?RenameFile@CExtendedDB@@QAEHPAD0@Z
?MoveFileA@CExtendedDB@@QAEHPAD000@Z
?GetCategoryMatches@CExtendedDB@@QAEHPAPADHPAPAJAAHPAPAH@Z
?MoveFolder@CExtendedDB@@QAEHPAD0@Z
?RemoveFileFromOneCategory@CExtendedDB@@QAEHPADJ@Z
?RemoveFileFromAllCategories@CExtendedDB@@QAEHPAD@Z
?CategoryNodeListGetFilesMatchAll@CExtendedDB@@QAEHPAJJAAHH@Z
?GetNthCategoryNodeFile@CExtendedDB@@QAEPADH@Z
?CategoryNodeGetFiles@CExtendedDB@@QAEHJAAHH@Z
?CategoryNodeListGetFiles@CExtendedDB@@QAEHPAJJAAHH@Z
?CategoryNodeGetName@CExtendedDB@@QAEHJPAD@Z
?CatNodeHasChildren@CExtendedDB@@QAEHJ@Z
?CategoryNodeAddFile@CExtendedDB@@QAEHJPAD@Z
?CatGetFirstChild@CExtendedDB@@QAEHJAAJ@Z
?DeleteCategoryNode@CExtendedDB@@QAEHJ@Z
?CatGetNextSibling@CExtendedDB@@QAEHJAAJ@Z
?AddCategoryNode@CExtendedDB@@QAEHJPADAAJ@Z
?SetDateSource@CExtendedDB@@QAEXW4DateSource@@@Z
?RenameCategoryNode@CExtendedDB@@QAEHJPADAAJ@Z
?GetFilesForDateRange@CExtendedDB@@QAEHVACDTime@@0AAH@Z
?SetMultiDateTimeForFile@CExtendedDB@@QAEHPADVACDTime@@11@Z
?GetNthTimeLineFile@CExtendedDB@@QAEPADH@Z
?CloseExtendedDB@CExtendedDB@@QAEHXZ
?SetDBDirectory@CExtendedDB@@QAEXPAD@Z
?FindDateTimeForFile@CExtendedDB@@QAEHPADAAVACDTime@@@Z
?CreateExtendedDB@CExtendedDB@@QAEHXZ
?OpenExtendedDB@CExtendedDB@@QAEHXZ
?Init@CExtendedDB@@QAEHXZ
??1CExtendedDB@@UAE@XZ
??0CExtendedDB@@QAE@XZ
?IsExtendedDBOpen@CExtendedDB@@QAEHXZ
?FileHasDateSourceItem@CExtendedDB@@QAEHPADW4DateSource@@@Z
?RemoveFilesFromCategories@CExtendedDB@@QAEHPAPADHPAJHH@Z
?DeleteFolder@CExtendedDB@@QAEHPAD@Z
?GetNextDateWithFiles@CExtendedDB@@QAEHVACDTime@@AAV2@@Z
?GetDateRangeInDB@CExtendedDB@@QAEHAAVACDTime@@0@Z
?RenameFolder@CExtendedDB@@QAEHPAD0@Z
?Optimize@CExtendedDB@@QAEHXZ
?GetSize@CExtendedDB@@QAEHAAJ@Z
?SetDBFilter@CExtendedDB@@QAEXPAPADHHH@Z
?CategoriesHaveFiles@CExtendedDB@@QAEHPAJH@Z
?SetAbort@CExtendedDB@@QAEHH@Z
?LockDB@CExtendedDB@@QAEHXZ
?GetPrevDateWithFiles@CExtendedDB@@QAEHVACDTime@@AAV2@@Z
?UnlockDB@CExtendedDB@@QAEHXZ
msvcp60
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Xlen@std@@YAXXZ
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
msvcrt
exit
_strdup
_mbschr
__set_app_type
__p__fmode
??2@YAPAXI@Z
_purecall
__CxxFrameHandler
free
realloc
malloc
_beginthreadex
_mbsrchr
_ftol
sprintf
fclose
fputs
fopen
atoi
strtok
_CxxThrowException
strtol
strchr
strncmp
toupper
_mbsbtype
vsprintf
_adjust_fdiv
__p__commode
_controlfp
_exit
wcslen
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
_initterm
_XcptFilter
__getmainargs
_acmdln
__setusermatherr
Sections
.text Size: 124KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ