muisetup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bd49da3075ad218d6669186de60e80f1_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bd49da3075ad218d6669186de60e80f1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bd49da3075ad218d6669186de60e80f1_JaffaCakes118
-
Size
248KB
-
MD5
bd49da3075ad218d6669186de60e80f1
-
SHA1
ecf634b260ef6f1b9e3c6f61668029ada7185917
-
SHA256
9b37b2fc4cf05da16805e8e5acd3a16b664e04da846626993edd15a0c44d0e4a
-
SHA512
f8f0cdad701056594405312a8c7298fa734e56e01a0476b512d7b2b6074d3e96a067310a65a9268d1d7e5110765785530909410fbae4582e2dd57976d8775271
-
SSDEEP
6144:wOAzuLK8cl3yQ8VwTT9HJm7Z/zHNgX5BX3+y0zt:LA78clXTJUx250zt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd49da3075ad218d6669186de60e80f1_JaffaCakes118
Files
-
bd49da3075ad218d6669186de60e80f1_JaffaCakes118.exe windows:5 windows x86 arch:x86
c1d533ebefb2bfc5721aac00fcd9664a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
PDB Paths
Imports
msvcrt
wcscmp
swprintf
memmove
wcstok
_wsplitpath
sprintf
strrchr
_c_exit
_exit
_XcptFilter
_cexit
wcstol
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
wcslen
_wcsicmp
exit
_wtoi64
wcscpy
wcschr
wcscat
wcsncpy
advapi32
RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
kernel32
GetTickCount
QueryPerformanceCounter
GetFileSize
ReadFile
CreateFileA
DosDateTimeToFileTime
LocalFileTimeToFileTime
TerminateProcess
SetFileAttributesA
_lcreat
_llseek
GetCurrentThreadId
_lwrite
_lread
_lopen
GetVersionExW
MoveFileExW
VerifyVersionInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
GetStartupInfoA
_lclose
GetSystemTimeAsFileTime
MultiByteToWideChar
RemoveDirectoryW
GetSystemDirectoryW
CreateDirectoryW
SetFileTime
VerSetConditionMask
GetWindowsDirectoryW
GetProcAddress
lstrcpyW
GetLocaleInfoW
GetLastError
CreateMutexW
GetCurrentProcessId
GetPrivateProfileStringW
GetVolumeInformationW
GetModuleFileNameW
CloseHandle
FreeLibrary
LocalFree
GetPrivateProfileIntW
GetSystemDefaultUILanguage
SetFileAttributesW
GetFileAttributesW
DeleteFileW
WaitForSingleObject
CreateProcessW
lstrcatW
WriteFile
CreateFileW
SetFilePointer
FormatMessageW
lstrlenW
LocalAlloc
GetCurrentProcess
ExitProcess
DeviceIoControl
LoadLibraryW
GetModuleHandleW
GetSystemInfo
lstrcmpW
GetUserDefaultUILanguage
GetDiskFreeSpaceExW
OutputDebugStringW
GetSystemDefaultLangID
GlobalFree
GetCommandLineW
FindClose
FindNextFileW
FindFirstFileW
lstrcmpiW
CopyFileW
WideCharToMultiByte
user32
LoadCursorW
wsprintfW
MessageBoxW
LoadStringW
SetForegroundWindow
ShowWindow
IsIconic
IsWindow
FindWindowW
SendMessageW
GetDlgItem
EndDialog
GetSystemMetrics
GetClientRect
SetWindowTextW
CreateDialogParamW
ExitWindowsEx
PostMessageW
SetWindowLongW
GetSysColor
DestroyWindow
EnableWindow
CheckDlgButton
IsDlgButtonChecked
SetCursor
SetDlgItemTextA
IsWindowVisible
GetDesktopWindow
CharLowerW
WinHelpW
LoadIconW
SetFocus
DialogBoxParamW
MessageBoxA
LoadStringA
DispatchMessageW
TranslateMessage
PeekMessageW
comctl32
ord17
setupapi
SetupCloseInfFile
SetupFindFirstLineW
SetupOpenInfFileW
SetupFindNextLine
SetupGetStringFieldW
SetupGetIntField
shlwapi
StrCatW
StrStrIW
StrRChrIW
PathCombineW
PathAppendW
PathFileExistsW
shell32
ord680
CommandLineToArgvW
ShellExecuteExW
lz32
LZClose
LZCopy
LZOpenFileW
GetExpandedNameW
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PACK Size: 160KB - Virtual size: 424KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE