Static task
static1
Behavioral task
behavioral1
Sample
297529814d8d292594a1981fad30daa6_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
297529814d8d292594a1981fad30daa6_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
297529814d8d292594a1981fad30daa6_JaffaCakes118
-
Size
221KB
-
MD5
297529814d8d292594a1981fad30daa6
-
SHA1
c309fa5f545a63d5b0ac9d7ea29da4bc4d80c39c
-
SHA256
2d4c44e898c568b9063c58ca179c022b74cbe3289f8aaea035ab2eeeaa11ec40
-
SHA512
80e141851463a5f72b8f3a4d71ba63bb52e368cf23f4a2b8986a371e65e0e2815926906584dc0042107d86adc1b41e0f352297961448863b530c4c6f7ab7afa3
-
SSDEEP
3072:ABkiKiaP/Rhk9G/0rEEpkMeq5u3w7O0XcgwYkofIaTwtiDJ/HTt/n4:3iKiaP/HaG/0rlp9JlOYvBkid7tv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 297529814d8d292594a1981fad30daa6_JaffaCakes118
Files
-
297529814d8d292594a1981fad30daa6_JaffaCakes118.exe windows:5 windows x86 arch:x86
a761745c18c06d243843adabc189b7c5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
FileTimeToSystemTime
SetFileTime
GetStringTypeW
DosDateTimeToFileTime
LCMapStringW
SuspendThread
GetPrivateProfileIntA
TlsGetValue
CompareStringA
GetSystemTimeAsFileTime
GetFileSize
GetVolumeInformationA
GetLastError
ConvertDefaultLocale
GetModuleHandleA
FreeResource
_lwrite
GetSystemDefaultUILanguage
MapViewOfFile
OpenFile
GetDiskFreeSpaceA
FlushFileBuffers
FindCloseChangeNotification
GetCommandLineA
GetCurrentDirectoryW
SetEndOfFile
InterlockedDecrement
RaiseException
CreateFileW
FindFirstChangeNotificationA
GetFileAttributesA
EnumResourceLanguagesA
VirtualProtect
lstrcpynA
lstrcatA
FileTimeToDosDateTime
GetUserDefaultUILanguage
SetThreadPriority
GetCurrentProcessId
GlobalFindAtomA
LoadLibraryA
SearchPathA
EnumResourceTypesA
GlobalHandle
GetModuleFileNameW
SetFileAttributesA
FindNextChangeNotification
GlobalLock
_lclose
GetStartupInfoW
HeapSetInformation
LocalReAlloc
GetModuleFileNameA
HeapReAlloc
GetCurrentProcess
Sleep
lstrlenW
GetEnvironmentStringsW
CreateDirectoryA
LocalAlloc
SetUnhandledExceptionFilter
ReplaceFileA
QueryPerformanceFrequency
HeapSize
IsDebuggerPresent
FreeEnvironmentStringsW
FindResourceW
InterlockedExchange
FindNextFileA
GlobalGetAtomNameA
lstrcmpiA
FindClose
CopyFileA
GetFileType
DeleteFileA
GetPrivateProfileStringA
GetCurrentDirectoryA
GetSystemInfo
SetFilePointer
UnlockFile
FindResourceExW
SetPriorityClass
SetEnvironmentVariableA
GetFileSizeEx
LoadResource
GlobalSize
GlobalAlloc
HeapAlloc
FormatMessageA
FindResourceExA
DuplicateHandle
GlobalDeleteAtom
LocalFree
FindFirstFileA
GlobalUnlock
WaitForMultipleObjects
LoadLibraryExA
lstrcpyA
WriteFile
GetTempFileNameA
GetFullPathNameA
TlsSetValue
CreateEventA
LockFile
SystemTimeToFileTime
SetHandleCount
FileTimeToLocalFileTime
GetDriveTypeW
InterlockedIncrement
LocalLock
FindFirstFileExA
GetVersionExA
WaitForSingleObject
CreateFileMappingA
GetACP
WideCharToMultiByte
LeaveCriticalSection
SetEvent
CreateThread
lstrcmpA
GetFileTime
GetModuleHandleW
CloseHandle
SizeofResource
TlsFree
TlsAlloc
GetFileAttributesExA
CompareStringW
ExpandEnvironmentStringsA
GetUserDefaultLangID
GlobalFree
IsProcessorFeaturePresent
UnhandledExceptionFilter
ResumeThread
HeapQueryInformation
GetSystemDirectoryA
EnterCriticalSection
QueryPerformanceCounter
GetLocalTime
GetNumberFormatA
SetStdHandle
CreateProcessA
RtlUnwind
_lcreat
GetProcessHeap
CreateFileA
LoadLibraryW
lstrlenA
HeapCreate
SetCurrentDirectoryA
SetLastError
HeapFree
IsValidCodePage
lstrcmpW
LocalFileTimeToFileTime
GetConsoleCP
EnumResourceNamesA
GlobalFlags
GlobalAddAtomA
GetOEMCP
LoadLibraryExW
CancelWaitableTimer
GetTickCount
OpenWaitableTimerA
OpenWaitableTimerW
AddAtomW
GetVersion
GlobalAddAtomW
AreFileApisANSI
WinExec
InitializeCriticalSection
CompareFileTime
GetConsoleMode
GetStringTypeExA
GetCurrentThread
GetThreadLocale
_lread
GetTimeZoneInformation
MoveFileA
ResetEvent
GetDriveTypeA
GetProcAddress
RemoveDirectoryA
GetSystemDirectoryW
GetCurrentThreadId
TerminateProcess
InitializeCriticalSectionAndSpinCount
GetStdHandle
GetTempPathA
FindResourceA
GetLocaleInfoA
LocalUnlock
MultiByteToWideChar
GetCPInfo
GetProfileIntA
GetWindowsDirectoryA
GetShortPathNameA
GetFileInformationByHandle
DeleteCriticalSection
FreeLibrary
MulDiv
LockResource
GlobalReAlloc
ReadFile
WriteConsoleW
WritePrivateProfileStringA
user32
DestroyCursor
PeekMessageW
GetMessageW
UpdateLayeredWindow
LoadImageW
GetWindowRect
TranslateAcceleratorW
GetDesktopWindow
IsWindowUnicode
GetKeyboardLayout
CharUpperA
LoadIconA
SetForegroundWindow
GetWindow
ScreenToClient
EnumWindows
ShowWindow
EnumChildWindows
GetMonitorInfoW
GetParent
TrackMouseEvent
DispatchMessageW
GetClassNameW
SetWindowTextW
UnregisterClassA
AppendMenuW
GetWindowLongW
DestroyMenu
SetWindowLongW
PtInRect
GetWindowTextW
SetCursor
MessageBeep
GetMenuItemInfoW
LoadStringW
GetCursorPos
MonitorFromWindow
InvalidateRect
GetWindowThreadProcessId
CharNextW
PostQuitMessage
TranslateMessage
GetWindowDC
CreatePopupMenu
LoadStringA
IsWindow
RemoveMenu
GetMenuItemCount
TrackPopupMenuEx
LoadCursorW
GetFocus
KillTimer
LoadMenuW
SetTimer
GetClientRect
SendMessageW
SetWindowPos
MonitorFromPoint
ReleaseDC
SetFocus
PostMessageW
CallWindowProcW
DrawTextW
MapWindowPoints
DefWindowProcW
advapi32
CloseServiceHandle
RegOpenKeyExW
RegCreateKeyExW
EnumDependentServicesW
SetEntriesInAclW
ReportEventW
GetTokenInformation
RegisterEventSourceW
OpenSCManagerW
RegCreateKeyW
OpenServiceW
RegQueryValueExW
SetNamedSecurityInfoW
OpenProcessToken
StartServiceW
DeregisterEventSource
CreateProcessAsUserW
ChangeServiceConfigW
DuplicateTokenEx
RegEnumKeyW
StartServiceCtrlDispatcherW
RevertToSelf
GetNamedSecurityInfoW
ControlService
DeleteService
RegSetValueExW
RegisterServiceCtrlHandlerExW
SetTokenInformation
SetServiceStatus
QueryServiceStatusEx
RegCloseKey
CreateServiceW
BuildExplicitAccessWithNameW
RegOpenKeyW
shell32
SHGetMalloc
SHEmptyRecycleBinW
SHGetSpecialFolderPathW
ole32
CoInitialize
shlwapi
PathFindFileNameW
PathRemoveFileSpecW
PathFileExistsW
PathCombineW
StrStrIW
PathAppendW
PathQuoteSpacesW
version
VerQueryValueW
oledlg
ord8
wtsapi32
WTSFreeMemory
WTSEnumerateSessionsW
psapi
GetModuleFileNameExW
GetModuleInformation
msvcrt
_except_handler3
_exit
__set_app_type
exit
_CIsin
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
Sections
.text Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ