Static task
static1
Behavioral task
behavioral1
Sample
dfb9e3dd3fc2b41a2169451a9e7924be_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dfb9e3dd3fc2b41a2169451a9e7924be_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dfb9e3dd3fc2b41a2169451a9e7924be_JaffaCakes118
-
Size
2.6MB
-
MD5
dfb9e3dd3fc2b41a2169451a9e7924be
-
SHA1
5322c502c38ab77379ec0823941d09d4cd52c49f
-
SHA256
14b5239f406c12c6ea99163ad0101e67121346586cb53548ebc9ca1440423707
-
SHA512
9b870a0a5cb4dde57423c0397973c25e5a3ce62f2c6cf202517a16b61d75170546555d202c6459b7d619f9e29f337e696468366345b40c67d7a0456af4841457
-
SSDEEP
49152:h0dZT4Zv0VggL9fn8rmrmvWLHSBREExy89f3j6AzzeS6lLg:h0d9Ev0px6vWGBy8Bzznb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dfb9e3dd3fc2b41a2169451a9e7924be_JaffaCakes118
Files
-
dfb9e3dd3fc2b41a2169451a9e7924be_JaffaCakes118.exe windows:5 windows x86 arch:x86
82d1f3d0b4106ad2c25aedb56caf6935
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempPathA
DeleteFileA
GetSystemDefaultLangID
GetFileSize
GetCurrentProcess
FormatMessageA
WriteFile
LeaveCriticalSection
ReadFile
FlushInstructionCache
SetCurrentDirectoryA
SetLastError
EnterCriticalSection
GetCurrentThreadId
GetVersionExA
GetModuleFileNameA
WaitForSingleObject
GetTickCount
GetExitCodeProcess
CreateProcessA
GetEnvironmentVariableA
GetCurrentDirectoryA
CompareStringA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
DebugBreak
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
Sleep
GetStdHandle
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapReAlloc
HeapCreate
GetStartupInfoA
GetCommandLineA
CloseHandle
OutputDebugStringA
GetModuleHandleA
FindNextFileA
GetDiskFreeSpaceA
ExitProcess
LoadLibraryA
FindClose
SetFileAttributesA
RemoveDirectoryA
GetProcAddress
GetLastError
FindFirstFileA
CreateDirectoryA
RaiseException
lstrlenW
MultiByteToWideChar
GetSystemDirectoryA
WideCharToMultiByte
GetWindowsDirectoryA
SetFileTime
InterlockedDecrement
InterlockedIncrement
FreeLibrary
lstrlenA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
DeleteCriticalSection
InitializeCriticalSection
CreateFileA
LCMapStringA
VirtualQuery
user32
LoadStringA
CharNextA
wvsprintfA
UnregisterClassA
GetWindow
MsgWaitForMultipleObjects
CharUpperA
SetCursor
SetTimer
GetWindowRect
SendDlgItemMessageA
FillRect
KillTimer
GetParent
wsprintfA
GetClientRect
GetWindowTextLengthA
SendMessageA
GetMonitorInfoA
TranslateMessage
GetWindowTextA
SetWindowLongA
MessageBoxA
InvalidateRect
GetWindowLongA
PeekMessageA
MonitorFromWindow
GetDlgItem
EndDialog
RedrawWindow
DestroyCursor
GetDesktopWindow
SetWindowPos
CheckDlgButton
EnumChildWindows
ShowWindow
GetSysColorBrush
IsDlgButtonChecked
IsWindow
DispatchMessageA
GetSystemMetrics
SetWindowTextA
LoadImageA
MapWindowPoints
EnableWindow
LoadCursorA
GetDlgCtrlID
GetDlgItemTextA
DialogBoxParamA
SetDlgItemTextA
gdi32
AddFontResourceA
BitBlt
SetTextColor
DeleteDC
CreateDIBSection
StretchBlt
CreateFontIndirectA
SetBkMode
DeleteObject
CreateCompatibleDC
SetStretchBltMode
GetObjectA
GetStockObject
CreateSolidBrush
SelectObject
advapi32
OpenSCManagerA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
CloseServiceHandle
CreateServiceW
RegCloseKey
shell32
SHGetMalloc
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA
ole32
CLSIDFromProgID
StringFromGUID2
OleInitialize
OleUninitialize
CoCreateInstance
oleaut32
SysAllocString
SysAllocStringByteLen
VarBstrCmp
SysAllocStringLen
SysStringByteLen
SysFreeString
SysStringLen
BstrFromVector
VariantClear
VariantCopyInd
LoadTypeLi
VariantCopy
VariantInit
VariantChangeType
RegisterTypeLi
comctl32
ord17
Sections
.text Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ