fcEXP
Static task
static1
Behavioral task
behavioral1
Sample
df4cc858af80228219a66a103e812f19_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
df4cc858af80228219a66a103e812f19_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df4cc858af80228219a66a103e812f19_JaffaCakes118
-
Size
4.5MB
-
MD5
df4cc858af80228219a66a103e812f19
-
SHA1
9f05b85dd26613f41982afa551bcebed1734cc88
-
SHA256
d8a2830adc1d144670c3f4d68666763270ad0c5e6a512149ff814e5687265f7b
-
SHA512
e3096c63507f1523a3b4922992e7eb98b164e2f14f67e74429a3e78a84f9a8de86f173c157a9bc9f0f03e5aea02cc802894d5d8595e7a115d701958e56896900
-
SSDEEP
98304:yMRenDzentXhm4jzFqB6f9FMedHpzh0Fvf/m7WKmvRa:F4DzfXfJa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df4cc858af80228219a66a103e812f19_JaffaCakes118
Files
-
df4cc858af80228219a66a103e812f19_JaffaCakes118.exe windows:4 windows x86 arch:x86
cbf644b78bc4ddb9303f71d79dc7f53f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegOpenKeyA
RegCreateKeyExA
RegCreateKeyA
RegOpenKeyExA
dinput8
DirectInput8Create
gdi32
SelectPalette
RealizePalette
GetDIBits
GetSystemPaletteEntries
CreatePalette
GetDeviceCaps
BitBlt
TextOutA
CreateDCA
CreateDIBSection
GetObjectA
SetBkColor
SetTextAlign
SetMapMode
DeleteDC
CreateCompatibleDC
CreateFontA
SelectObject
DeleteObject
GetStockObject
SetBkMode
SetROP2
AddFontResourceA
EnumFontFamiliesA
SetTextColor
CreateCompatibleBitmap
GetTextExtentPoint32A
ExtTextOutA
imm32
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmAssociateContext
ImmSetStatusWindowPos
kernel32
GetModuleHandleA
WideCharToMultiByte
lstrlenW
InterlockedIncrement
InterlockedDecrement
GlobalUnlock
GlobalLock
GlobalReAlloc
GetTempFileNameA
SetThreadPriority
SetEvent
ResetEvent
CreateEventA
GetSystemTime
WaitForSingleObject
SetEndOfFile
TerminateThread
SetLastError
GetCurrentProcess
VirtualQuery
VirtualFree
GetVersion
VirtualAlloc
IsBadReadPtr
GetCurrentThreadId
CopyFileA
GetWindowsDirectoryA
SetThreadAffinityMask
GetCurrentThread
CreateMutexA
GlobalMemoryStatus
CreateFileMappingA
MapViewOfFile
GetLocaleInfoW
CreateThread
SetStdHandle
TerminateProcess
GetStringTypeW
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
FlushFileBuffers
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
SetUnhandledExceptionFilter
GetOEMCP
GetACP
HeapSize
TlsGetValue
TlsAlloc
TlsSetValue
CompareStringW
CompareStringA
GetCPInfo
LCMapStringW
LCMapStringA
GetCommandLineA
GetStartupInfoA
MoveFileA
GetFileAttributesA
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
RaiseException
GetTimeZoneInformation
RtlUnwind
InterlockedExchange
ExitProcess
GetSystemDefaultLangID
GetExitCodeThread
HeapFree
CreateFileW
UnmapViewOfFile
MultiByteToWideChar
GetProcAddress
OpenProcess
LoadLibraryA
FreeLibrary
GetPrivateProfileIntA
IsBadCodePtr
GetPrivateProfileStringA
FindNextFileA
WritePrivateProfileStringA
GetCurrentDirectoryA
CreateDirectoryA
FindFirstFileA
FindClose
lstrcpynA
GetTickCount
lstrcpyA
GetLastError
lstrcatA
DeleteFileA
GetLocalTime
SetFilePointer
GetFileSize
ReadFile
GlobalAlloc
GlobalFree
GetModuleFileNameA
WriteFile
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetVersionExA
Sleep
MulDiv
CreateFileA
CloseHandle
lstrcmpA
EnterCriticalSection
LeaveCriticalSection
lstrlenA
SetCurrentDirectoryA
lstrcmpiA
SetEnvironmentVariableA
oleaut32
SysAllocString
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
VariantCopy
VariantChangeType
VariantClear
VariantInit
shell32
ShellExecuteA
user32
RegisterClassExA
FlashWindow
SetRect
PtInRect
LoadCursorA
GetClassInfoA
RemovePropA
SetPropA
GetPropA
UnregisterClassA
CopyRect
IsRectEmpty
TranslateMessage
LoadIconA
GetWindowRect
ClipCursor
DestroyWindow
GetCursor
SetCursor
EnumWindows
CharUpperA
IsWindowVisible
GetParent
ReleaseDC
GetDC
SendMessageA
RegisterClassA
BeginPaint
EndPaint
DispatchMessageA
PeekMessageA
SetActiveWindow
ScreenToClient
GetDoubleClickTime
SetWindowLongA
CreateWindowExA
GetClassNameA
GetWindowThreadProcessId
GetKeyboardLayout
CallWindowProcA
SetFocus
SetWindowTextA
MoveWindow
GetWindowTextA
CharLowerA
wsprintfA
MessageBoxA
GetActiveWindow
DefWindowProcA
GetClientRect
PostQuitMessage
ShowCursor
GetCursorPos
SetWindowPos
ChangeDisplaySettingsA
AdjustWindowRect
EnumDisplaySettingsA
GetWindowLongA
SetRectEmpty
EqualRect
GetAsyncKeyState
SetCursorPos
ClientToScreen
SetForegroundWindow
UpdateWindow
ShowWindow
InvalidateRect
GetSystemMetrics
wininet
DeleteUrlCacheEntry
winmm
PlaySoundA
timeGetTime
wsock32
send
ntohs
inet_ntoa
recv
ioctlsocket
htons
socket
htonl
setsockopt
connect
WSAAsyncSelect
closesocket
WSACleanup
WSAStartup
gethostname
gethostbyname
inet_addr
ntohl
WSAGetLastError
getsockname
d3d8
Direct3DCreate8
mss32
_AIL_set_redist_directory@4
_AIL_quick_startup@20
_AIL_quick_handles@12
_AIL_set_digital_master_room_type@8
_AIL_set_DirectSound_HWND@8
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_open_3D_listener@4
_AIL_set_3D_orientation@28
_AIL_set_3D_sample_loop_count@8
_AIL_quick_play@8
_AIL_set_stream_position@8
_AIL_start_stream@4
_AIL_set_3D_position@16
_AIL_quick_set_volume@12
_AIL_quick_halt@4
_AIL_quick_shutdown@0
_AIL_pause_stream@8
_AIL_set_3D_sample_volume@8
_AIL_set_stream_volume_levels@12
_AIL_quick_status@4
_AIL_3D_sample_status@4
_AIL_stream_status@4
_AIL_file_read@8
_AIL_file_size@4
_AIL_file_type@8
_AIL_decompress_ASI@24
_AIL_WAV_info@8
_AIL_decompress_ADPCM@12
_AIL_quick_load_mem@8
_AIL_allocate_3D_sample_handle@4
_AIL_set_3D_sample_file@8
_AIL_open_stream@12
_AIL_set_stream_loop_count@8
_AIL_quick_unload@4
_AIL_release_3D_sample_handle@4
_AIL_close_stream@4
_AIL_mem_free_lock@4
_AIL_end_3D_sample@4
_AIL_start_3D_sample@4
ole32
CoInitialize
CLSIDFromString
CoCreateInstance
CoUninitialize
urlmon
URLDownloadToFileA
Exports
Exports
Sections
.text Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 275KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 283KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE