Static task
static1
Behavioral task
behavioral1
Sample
110f45f0e231d88abb83276169d14921_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
110f45f0e231d88abb83276169d14921_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
110f45f0e231d88abb83276169d14921_JaffaCakes118
-
Size
277KB
-
MD5
110f45f0e231d88abb83276169d14921
-
SHA1
bfbc2368650b627673f7e49eb2bcadbbf0a0be69
-
SHA256
b97fb2327314ef18f8319d74ac8bfefbe940bd156b5ca2c284d2d7902d72f568
-
SHA512
3d4d5a7d5e95b519978d0455a30b5ae2e005d529e46da3bc74802a2af920904affb65afcb5c288c4b0e4c75ed22ff6c7a4eb6c80ec3a8746c26c98112179ecb1
-
SSDEEP
6144:G6FyHwU+uQ5Srp3ybPFQNu8MDKkqZyft8T8cEfkXb1lcD8aDiuYnNlnx5:G7zUAZSKu8U7l5cEG3oTDiVnJ5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 110f45f0e231d88abb83276169d14921_JaffaCakes118
Files
-
110f45f0e231d88abb83276169d14921_JaffaCakes118.exe windows:4 windows x86 arch:x86
b956c59907e4d0c4d315ad83d100d333
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetSidLengthRequired
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
MakeAbsoluteSD
RegDeleteKeyW
GetTokenInformation
OpenThreadToken
ConvertStringSidToSidW
GetSecurityDescriptorDacl
RegCreateKeyExW
ConvertSidToStringSidW
GetSidSubAuthority
OpenProcessToken
InitializeSecurityDescriptor
InitializeSid
RegCloseKey
GetLengthSid
MakeSelfRelativeSD
InitializeAcl
IsValidSid
GetSidSubAuthorityCount
LookupAccountSidW
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
EqualSid
GetSecurityDescriptorGroup
CopySid
GetSecurityDescriptorControl
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
RegOpenKeyExW
RegDeleteValueW
GetAclInformation
AddAce
GetSecurityDescriptorSacl
oleaut32
SafeArrayGetVartype
SysAllocString
SysAllocStringByteLen
SafeArrayUnlock
SysFreeString
VariantClear
VariantCopy
VarCmp
SafeArrayCreate
VariantInit
SysStringByteLen
SysAllocStringLen
SafeArrayRedim
VariantChangeType
SysStringLen
VarUI4FromStr
UnRegisterTypeLi
LoadTypeLi
VarBstrCmp
LoadRegTypeLi
SetErrorInfo
SafeArrayLock
SafeArrayGetLBound
VariantCopyInd
CreateErrorInfo
SafeArrayDestroy
RegisterTypeLi
SafeArrayCopy
SafeArrayGetUBound
kernel32
DeleteCriticalSection
LoadLibraryExW
FindResourceExW
HeapFree
HeapSize
HeapDestroy
FormatMessageW
LocalFree
SetThreadLocale
GetThreadLocale
EnterCriticalSection
HeapReAlloc
FreeLibrary
CreateEventW
UnhandledExceptionFilter
lstrlenW
LeaveCriticalSection
LoadResource
ResetEvent
GetCurrentThreadId
SizeofResource
GetModuleHandleW
IsDebuggerPresent
GetACP
LockResource
RaiseException
SetUnhandledExceptionFilter
FindResourceW
GetSystemTimeAsFileTime
GetProcessHeap
CloseHandle
lstrcmpiW
HeapAlloc
LoadLibraryA
VirtualAlloc
ole32
ProgIDFromCLSID
CoTaskMemAlloc
CoTaskMemFree
CoRevertToSelf
StringFromGUID2
CoTaskMemRealloc
CoCreateInstance
CoImpersonateClient
user32
UnregisterClassA
LoadStringW
wsprintfW
CharNextW
userenv
UnloadUserProfile
esent
JetCreateTable
JetRetrieveTaggedColumnList
JetDetachDatabase2
JetSetTableSequential
JetGetLogInfo
JetInit3
JetRetrieveColumns
JetEndExternalBackupInstance
JetGetAttachInfoInstance
JetAttachDatabase2
JetExternalRestore
ese
JetGetTruncateLogInfoInstance
JetSetSystemParameter
JetDeleteColumn2
mspatcha
GetFilePatchSignatureW
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 246KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ