Static task
static1
Behavioral task
behavioral1
Sample
103d251af89b00dd7fcf21592d101508_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
103d251af89b00dd7fcf21592d101508_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
103d251af89b00dd7fcf21592d101508_JaffaCakes118
-
Size
144KB
-
MD5
103d251af89b00dd7fcf21592d101508
-
SHA1
a3fed4f17667390fb969a2f8bb0befa87837ec2f
-
SHA256
4d470810d00b935e27943f000b75586be62784b7bfd176c4d59d751a8208b553
-
SHA512
f842bd662109b5f7fadccbe0aa3e74f8bfa895cc9f9d3286e579dc6cd4a0427f0a76789bf80b9042881f2c0f3e6c04f1dcc6dd6e72fc67aa668ccdbab3b15aa7
-
SSDEEP
3072:A+BxZjsEakD3xzqVSUehP7itoDU4xutV4:n+S/POGU4xutO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 103d251af89b00dd7fcf21592d101508_JaffaCakes118
Files
-
103d251af89b00dd7fcf21592d101508_JaffaCakes118.exe windows:4 windows x86 arch:x86
0f93dddcdbbbba4d4bba2c1111f0aef3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
IsDBCSLeadByte
GetSystemDirectoryA
GetTickCount
lstrlenA
Process32Next
OpenEventA
SetLastError
GetCurrentThread
GetCurrentDirectoryA
GetTempPathA
GetVersion
WideCharToMultiByte
lstrcatA
lstrcmpiA
InterlockedDecrement
Sleep
ReadFile
SetFilePointer
SetEndOfFile
FlushFileBuffers
FindResourceA
LoadResource
LockResource
SizeofResource
CreateFileA
WriteFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
FreeResource
CreateProcessA
WaitForSingleObject
lstrcpyA
ExpandEnvironmentStringsA
SetFileAttributesA
FindNextFileA
RemoveDirectoryA
GetFileAttributesA
FindFirstFileA
FindClose
OutputDebugStringA
GetPrivateProfileStringA
GetPrivateProfileSectionA
GetVersionExA
MoveFileExA
GetWindowsDirectoryA
WritePrivateProfileStringA
GetShortPathNameA
DeleteFileA
GetCurrentProcess
FreeLibrary
GetLastError
CloseHandle
GetModuleHandleA
LoadLibraryA
GetProcAddress
SetEvent
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
SetStdHandle
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedCompareExchange
GetCurrentProcessId
DeviceIoControl
LocalFree
LocalAlloc
InterlockedExchange
RaiseException
MultiByteToWideChar
RtlUnwind
HeapFree
HeapAlloc
GetStartupInfoA
GetCommandLineA
ExitProcess
GetTimeZoneInformation
GetSystemTime
GetLocalTime
SetHandleCount
GetStdHandle
GetFileType
GetCPInfo
GetACP
GetOEMCP
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
user32
SendMessageTimeoutA
SetDlgItemTextA
UpdateWindow
FindWindowA
LoadIconA
SendMessageA
ShowWindow
EndDialog
wsprintfA
PeekMessageA
TranslateMessage
DispatchMessageA
ExitWindowsEx
GetClientRect
MapWindowPoints
SetWindowPos
LoadStringA
GetDesktopWindow
MessageBoxA
DialogBoxParamA
EnableWindow
GetDlgItem
advapi32
InitializeSid
RegSetValueExA
RegSetKeySecurity
OpenThreadToken
InitializeSecurityDescriptor
GetSidSubAuthority
SetSecurityDescriptorOwner
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetSidLengthRequired
EnumDependentServicesA
QueryServiceStatus
GetUserNameA
ControlService
OpenSCManagerA
OpenServiceA
CloseServiceHandle
DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
comctl32
InitCommonControlsEx
shlwapi
SHDeleteKeyA
shell32
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ole32
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
VariantClear
GetErrorInfo
SysAllocString
Sections
.text Size: 92KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ