?FindLatestSection@@YAGPADG@Z
Static task
static1
Behavioral task
behavioral1
Sample
0b5fe41aa8053282e3457f7d9f530072_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b5fe41aa8053282e3457f7d9f530072_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0b5fe41aa8053282e3457f7d9f530072_JaffaCakes118
-
Size
229KB
-
MD5
0b5fe41aa8053282e3457f7d9f530072
-
SHA1
8ae16d96e8f7f52d7be3e26f4df0fea9d005d73e
-
SHA256
d2100756419b46624cad6a303a60c8cff1c8e40112623e396b02867dbe7fbdf0
-
SHA512
e570843a95409a21b782712f3eebe56815db01e6ca59caade5d158afd565dfbb1dfb28155495106ff55d4d75d510c89f7e86df29d73e7c5e3f9158b5d150bab7
-
SSDEEP
6144:DhvRaoghwy8Im3WHRmnvklBkSRQcIdkUkH:DFghsIm3MRmviNQHkH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b5fe41aa8053282e3457f7d9f530072_JaffaCakes118
Files
-
0b5fe41aa8053282e3457f7d9f530072_JaffaCakes118.exe windows:4 windows x86 arch:x86
f684d482986e7943a7ab9b42a025a96c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHDeleteKeyA
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
shell32
SHChangeNotify
kernel32
GetShortPathNameA
GetTempPathA
SetFileAttributesA
CopyFileA
DeleteFileA
GetSystemDirectoryA
GetWindowsDirectoryA
LocalFree
InterlockedExchange
GetThreadLocale
GetLocaleInfoA
GetACP
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
CreateMutexA
ReleaseMutex
DeleteCriticalSection
Sleep
InitializeCriticalSection
GetModuleFileNameA
GetExitCodeThread
LoadLibraryExA
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
GetPrivateProfileStringA
lstrcpyA
lstrcatA
FindFirstFileA
lstrcmpiA
FindNextFileA
FindClose
CreateDirectoryA
GetLocalTime
VirtualQuery
SetUnhandledExceptionFilter
WriteFile
IsBadWritePtr
WritePrivateProfileStringA
OutputDebugStringA
GlobalMemoryStatus
QueryPerformanceCounter
GetLogicalDrives
GetPrivateProfileSectionNamesA
GetDiskFreeSpaceA
GetSystemInfo
QueryPerformanceFrequency
GetPrivateProfileIntA
lstrlenA
lstrcpynA
TerminateProcess
GetExitCodeProcess
ResetEvent
ResumeThread
CreateEventA
LocalAlloc
OpenMutexA
SetLastError
GetFileAttributesA
ReadFile
SetEndOfFile
IsBadCodePtr
IsBadReadPtr
CreateFileA
SetStdHandle
VirtualProtect
SetFilePointer
VirtualAlloc
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
FlushFileBuffers
UnhandledExceptionFilter
CloseHandle
GetCurrentThread
GetVersionExA
GetLastError
WaitForSingleObject
CreateProcessA
FreeLibrary
GetTickCount
LoadLibraryA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
HeapReAlloc
GetOEMCP
CompareStringA
CompareStringW
GetCPInfo
GetDriveTypeA
SetEnvironmentVariableA
HeapSize
LCMapStringW
LCMapStringA
TlsGetValue
TlsSetValue
TlsFree
HeapFree
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
ExitProcess
RtlUnwind
RaiseException
HeapDestroy
HeapCreate
VirtualFree
TlsAlloc
user32
DestroyWindow
LoadStringA
GetMessageA
TranslateMessage
DispatchMessageA
LoadIconA
MsgWaitForMultipleObjects
PeekMessageA
SendMessageA
RegisterClassA
EnumDisplaySettingsA
SystemParametersInfoA
MessageBoxA
GetDesktopWindow
ExitWindowsEx
DefWindowProcA
PostQuitMessage
KillTimer
FindWindowA
SetTimer
PostMessageA
wsprintfA
CreateWindowExA
RegisterClassExA
LoadCursorA
advapi32
RegDeleteKeyA
RegDeleteValueA
IsValidSid
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyA
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegEnumValueA
ole32
OleInitialize
OleUninitialize
CoCreateInstance
StringFromGUID2
CoCreateGuid
Exports
Exports
Sections
.text Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ