ThreadSynchronize
Static task
static1
Behavioral task
behavioral1
Sample
0a2f18b021ce1d24ee5a3e997cf58404_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0a2f18b021ce1d24ee5a3e997cf58404_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0a2f18b021ce1d24ee5a3e997cf58404_JaffaCakes118
-
Size
79KB
-
MD5
0a2f18b021ce1d24ee5a3e997cf58404
-
SHA1
6442365f3fd270e5338829e4ac14d9e496180152
-
SHA256
d09e331aed35c9f011c99877081dd90cacc8d987ab66d004edac5addaf417464
-
SHA512
c65a1e6527eb3e5fed36c922f5c16671c8ae0aaebe0c26ef71df3b4f0b6bf683f67dc6aa1a04104f39f67f7f2f9ba298209f7bf87b5d4277c46e4109311280c5
-
SSDEEP
1536:07pgiePzY9tbI/ocp8jtbDdz/a7yWZWxQk0tzRTOFxyRbhJd0:OpgiGstbI/Dp8xPpi7ZZWxctzRSglnd0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a2f18b021ce1d24ee5a3e997cf58404_JaffaCakes118
Files
-
0a2f18b021ce1d24ee5a3e997cf58404_JaffaCakes118.exe windows:4 windows x86 arch:x86
6a7ebe4d30e4a3493d8a64fe686698c9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
AddAtomW
ChangeTimerQueueTimer
CloseHandle
CreateFileW
CreateMailslotW
DisableThreadLibraryCalls
EnumLanguageGroupLocalesA
ExitProcess
ExitThread
FindAtomW
GetCommandLineA
GetCurrentThreadId
GetFileSizeEx
GetLogicalDriveStringsA
GetModuleHandleA
GetPrivateProfileSectionNamesW
GetPrivateProfileStructA
GetStartupInfoA
GetStringTypeA
GetSystemDefaultLangID
GetTapePosition
GetTimeZoneInformation
GetVersionExA
GlobalGetAtomNameA
GlobalReAlloc
GlobalSize
HeapAlloc
HeapCreate
HeapDestroy
IsBadWritePtr
LoadLibraryA
LocalSize
MoveFileExW
MoveFileWithProgressA
OpenEventW
SetCalendarInfoW
SetFilePointerEx
SetProcessPriorityBoost
VerifyVersionInfoA
lstrcpynA
user32
CallWindowProcA
DeleteMenu
DialogBoxParamA
DrawMenuBar
EmptyClipboard
EndDialog
FindWindowA
GetMenuItemCount
GetSysColorBrush
GetWindow
GetWindowTextA
InvalidateRgn
IsDialogMessageA
IsZoomed
LoadCursorA
OffsetRect
OpenClipboard
PostMessageA
ScreenToClient
SetWindowPlacement
SetWindowTextA
UnionRect
WindowFromPoint
advapi32
StartTraceA
SetUserFileEncryptionKey
SetSecurityDescriptorOwner
RegQueryValueExA
RegOpenKeyW
RegOpenKeyExA
RegLoadKeyW
RegEnumKeyA
RegDeleteKeyW
ObjectPrivilegeAuditAlarmW
LsaSetTrustedDomainInformation
LsaSetDomainInformationPolicy
LsaRemovePrivilegesFromAccount
LsaCreateTrustedDomainEx
LsaClose
GetTrusteeNameA
GetSidLengthRequired
GetSecurityInfoExW
GetNamedSecurityInfoA
FreeSid
EnumServicesStatusExA
ElfClearEventLogFileA
CryptGetKeyParam
AddAuditAccessAceEx
AdjustTokenGroups
CheckTokenMembership
CloseEncryptedFileRaw
CloseTrace
ConvertSidToStringSidA
ConvertStringSDToSDRootDomainW
olepro32
OleCreatePropertyFrame
oleacc
GetRoleTextA
AccessibleObjectFromEvent
AccessibleChildren
security
ImportSecurityContextA
AddSecurityPackageW
QuerySecurityContextToken
QuerySecurityPackageInfoA
comctl32
ImageList_GetDragImage
FlatSB_SetScrollProp
CreatePropertySheetPageA
ImageList_Add
ImageList_Copy
ImageList_Destroy
ImageList_DragShowNolock
FlatSB_SetScrollRange
ImageList_GetImageRect
ImageList_SetIconSize
LBItemFromPt
MenuHelp
PropertySheetW
oledlg
OleUIConvertA
OleUIEditLinksA
OleUIChangeSourceA
OleUIBusyA
comdlg32
dwLBSubclass
ReplaceTextW
PrintDlgW
PrintDlgExW
GetSaveFileNameA
PrintDlgA
ReplaceTextA
Exports
Exports
Sections
.text Size: 48KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ