Static task
static1
Behavioral task
behavioral1
Sample
177c0ad0f50ce53cc78e94ecd8c00e73_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
177c0ad0f50ce53cc78e94ecd8c00e73_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
177c0ad0f50ce53cc78e94ecd8c00e73_JaffaCakes118
-
Size
89KB
-
MD5
177c0ad0f50ce53cc78e94ecd8c00e73
-
SHA1
3ceae50f2802fb728f029cba9a39f2f3bdc21815
-
SHA256
b62a82028b756a312e0517b544053e0f9fbdd1704cfc36d20d2f166fdf9216bc
-
SHA512
eecccf0ff7abcc094b226b6c5c2a9e62365b5432de584e6a82f111664d83cec20a0ae1be884d7c7dfe3d287cb71501d926e22b288e3d9662a0b7e0c4aec70607
-
SSDEEP
1536:8JoCTE1r5lBYfqf3P62G00a5HsTTx2ORFK7ULAD5:wZY1r5Mfi5v5Ha2ORFGULY5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 177c0ad0f50ce53cc78e94ecd8c00e73_JaffaCakes118
Files
-
177c0ad0f50ce53cc78e94ecd8c00e73_JaffaCakes118.exe windows:5 windows x86 arch:x86
a19234b6ae0ec38914acebf111d4c344
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gamevancelib32
?GetExcludedUrlsSeq@@YGKPAD@Z
GetUuid
?HostToIP@@YGHPAD0K@Z
?Base64EncodeFunc@@YGHPAD0H@Z
?CanCheckPopup@@YGHPAU_TSharedStruct@@PAU_tagPopupInfo@@@Z
?GetWindowsProductId@@YGHPADK@Z
?GetDefaultCfgServer@@YGHPADK0@Z
?IsWindowsVista@@YAHXZ
?GetGeoIPCountryCode@@YGHPADH0@Z
?SetLastPopupTimeNT@@YGHU_FILETIME@@PAD@Z
?string_table_delete_all@@YGHPAUst_string_table@@@Z
?SetExcludedUrlsSeq@@YGHKPAD@Z
?SetPopupCountNT@@YGHKPAD@Z
SetAdLocation
?ParsePopupData@@YGHPADPAU_tagPopupData@@@Z
?SetCheckPopServer@@YGHPAD0@Z
?SetClientId@@YGHPAD0@Z
?SaveQoolPopups_T@@YGHPAU_tagQoolPopup@@PAD@Z
?SetLastPopupTimeT@@YGHU_FILETIME@@PAD@Z
?SaveQoolPopups_NT@@YGHPAU_tagQoolPopup@@PAD@Z
?SetPopupInProgress@@YGHH@Z
?SetPopupCountT@@YGHKPAD@Z
?SetGeoIPCountryCode@@YGHPAD0@Z
?ShowPopupInDefaultBrowser@@YGHKPAU_tagPopupData@@@Z
?ShowPopupInDefaultBrowser2@@YGHKPAU_tagPopupData@@@Z
?AddFiredPid@@YGHPAPAU_tagQoolPopup@@HH@Z
?xml_parse_config@@YGHPADPAPAU_tagCONFIG_STRUCT@@PAHPAUst_string_table@@@Z
?SetPopupsStatusDisabled@@YGHKPAD@Z
?string_table_add@@YGHPAUst_string_table@@PAD@Z
?SetDefaultCfgServer@@YGHPAD0@Z
?GetLastPopupTimeNT@@YG?AU_FILETIME@@PAD@Z
?GetLastPopupTimeT@@YG?AU_FILETIME@@PAD@Z
?RemoveOldPopups@@YGHPAPAU_tagQoolPopup@@@Z
?IsPopupInProgress@@YGHXZ
?GetClientId@@YGHPADK0@Z
?DeleteRecoveryModule@@YAXXZ
?GetUniqueClientId@@YGHPADK@Z
GetAdLocation
?GetClientInstallDate@@YG?AU_FILETIME@@XZ
?FindBrowserWindow@@YGPAUHWND__@@K@Z
?IsPopupEngineDisabled@@YGHXZ
?IsHeaderFirstRun@@YGHXZ
?GetCfgFilePath@@YGHPADH@Z
?LoadFiredPopups_T@@YGHPAPAU_tagQoolPopup@@PAD@Z
?GetOSVersionString@@YGHPADK@Z
?string_table_alloc@@YGHPAPAUst_string_table@@@Z
?IsWindowsMe@@YGHXZ
?GetWS2SendFrame@@YGHPADK@Z
?GetIEVersion@@YGXPADK@Z
?ScheduleFileUpdate@@YGXPAD0@Z
?FileTimeSecondsBetween@@YG_JU_FILETIME@@0@Z
?GetHardwareHashCrcHex@@YGHPADH@Z
?GetPopupCountT@@YGKPAD@Z
?GetCrc64@@YGHPADK0@Z
?ParsePacketContent@@YGHPAU_tagHttpData@@PAUHWND__@@PAUst_string_table@@2PAPAU_tagQoolPopup@@3H@Z
?ModuleFromAddress@@YGPAUHINSTANCE__@@PAX@Z
?LoadFiredPopups_NT@@YGHPAPAU_tagQoolPopup@@PAD@Z
?SetClientInstallDate@@YGXU_FILETIME@@@Z
?GetPopupCountNT@@YGKPAD@Z
?GetCheckPopServer@@YGHPADK0@Z
?SetCrc64@@YGHPAD0@Z
shlwapi
StrNCatA
StrStrA
wnsprintfA
StrStrIA
kernel32
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetLocaleInfoA
HeapSize
RtlUnwind
VirtualAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LeaveCriticalSection
QueryPerformanceCounter
VirtualFree
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
GetModuleHandleW
GetStartupInfoA
GetCommandLineA
EnterCriticalSection
IsBadReadPtr
ReleaseMutex
OpenMutexA
ExitProcess
lstrlenA
MapViewOfFile
lstrcpynA
HeapAlloc
SetUnhandledExceptionFilter
SystemTimeToFileTime
HeapFree
GetTickCount
GetProcessHeap
GetSystemTimeAsFileTime
Sleep
CreateProcessA
IsBadWritePtr
GetLastError
GetProcAddress
GetLocalTime
LoadLibraryA
CreateFileMappingA
GetModuleFileNameA
CreateMutexA
CloseHandle
GetCurrentProcessId
LocalFree
lstrcpyA
lstrcatA
HeapReAlloc
VirtualQuery
WriteFile
HeapDestroy
HeapCreate
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObject
user32
GetLastInputInfo
DefWindowProcA
CreateWindowExA
TranslateMessage
SendMessageA
ShowWindow
PostQuitMessage
RegisterClassExA
SetTimer
GetMessageA
DestroyWindow
RegisterWindowMessageA
PostMessageA
DispatchMessageA
FindWindowA
KillTimer
advapi32
SetNamedSecurityInfoA
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegCloseKey
RegDeleteValueA
ole32
CoInitialize
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ