Static task
static1
Behavioral task
behavioral1
Sample
29219b850a9c993495c4cf022af6022f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
29219b850a9c993495c4cf022af6022f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
29219b850a9c993495c4cf022af6022f_JaffaCakes118
-
Size
141KB
-
MD5
29219b850a9c993495c4cf022af6022f
-
SHA1
a182997ded38d1e6357dd090a672e110586c0ac2
-
SHA256
bad98e5f8289340b8bd679fe16e379d45eef10a4846a854934251813aa9975ce
-
SHA512
980a25cc4d799ecbf44a22a6b933dbe0865862bab164c68d20798347257057c6038729f4e84ef3d80b11bfd23cc6106dd956bcd6a717ceee57891042a4607372
-
SSDEEP
3072:0FxzDvFTFre8BgEIUlRlHLcvtz+WaBYLBwgUtrmL0D+SV/NMh:0FnTHBgEHfmRHUtC0DnV/ah
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29219b850a9c993495c4cf022af6022f_JaffaCakes118
Files
-
29219b850a9c993495c4cf022af6022f_JaffaCakes118.exe windows:4 windows x86 arch:x86
3717b6bb7b9dd98899ac85d9c849b8d5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
advapi32
GetAce
OpenProcessToken
RegSetValueExA
SetThreadToken
SetSecurityDescriptorGroup
DeleteService
DuplicateToken
RegQueryInfoKeyA
RegEnumKeyExA
AccessCheck
GetSecurityDescriptorDacl
MakeAbsoluteSD
RegDeleteKeyA
ReportEventA
RegQueryValueExA
EqualSid
RegCreateKeyA
RegEnumValueA
LookupAccountNameA
GetSecurityDescriptorGroup
CloseServiceHandle
RegQueryValueExW
GetSidSubAuthority
GetLengthSid
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
RegCloseKey
RegEnumKeyA
LookupPrivilegeValueA
AddAccessAllowedAce
OpenServiceA
IsValidSecurityDescriptor
MakeSelfRelativeSD
AddAce
ChangeServiceConfigA
PrivilegeCheck
DuplicateTokenEx
IsValidSid
GetSecurityDescriptorControl
AllocateAndInitializeSid
RegConnectRegistryA
FreeSid
GetSidLengthRequired
SetSecurityDescriptorDacl
SetServiceStatus
GetUserNameA
StartServiceCtrlDispatcherA
RegOpenKeyExA
GetAclInformation
InitializeSecurityDescriptor
OpenSCManagerA
AddAccessDeniedAce
GetTokenInformation
RegDeleteValueA
AdjustTokenPrivileges
DeregisterEventSource
CopySid
RegisterServiceCtrlHandlerA
SetSecurityDescriptorOwner
ControlService
CreateServiceA
RegCreateKeyExA
RegSetKeySecurity
QueryServiceStatus
LookupAccountSidA
GetSecurityDescriptorSacl
LookupAccountSidW
InitializeAcl
InitializeSid
OpenThreadToken
RegisterEventSourceA
SetSecurityDescriptorSacl
RegOpenKeyExW
ole32
CoGetCallContext
CoCreateInstance
CoGetClassObject
StringFromCLSID
CoTaskMemRealloc
CoCreateGuid
CoUninitialize
CoSetProxyBlanket
CLSIDFromString
CoTaskMemAlloc
CoRevertToSelf
CoQueryProxyBlanket
CoInitializeSecurity
CoTaskMemFree
CoImpersonateClient
CoDisconnectObject
CoRegisterClassObject
StringFromIID
CoInitializeEx
StringFromGUID2
CoRevokeClassObject
shlwapi
PathFindExtensionA
rpcrt4
RpcBindingFromStringBindingA
RpcStringBindingComposeA
RpcBindingSetAuthInfoA
NdrClientCall
RpcStringFreeA
user32
CharUpperA
PostThreadMessageA
EnumWindows
SetTimer
GetMessageA
LoadStringA
GetWindowTextA
MessageBoxA
PeekMessageA
IsWindowVisible
GetWindowThreadProcessId
KillTimer
CharNextA
wsprintfW
DispatchMessageA
wsprintfA
kernel32
GetFileType
Sleep
GetComputerNameA
FormatMessageA
SetLastError
GetModuleHandleA
GetProcessHeap
LCMapStringA
DuplicateHandle
UnmapViewOfFile
WideCharToMultiByte
GetCurrentProcessId
SizeofResource
SetEnvironmentVariableA
CompareStringW
GetTickCount
TlsSetValue
CreateProcessA
TerminateProcess
DeleteCriticalSection
CreateMutexA
GetLastError
GetPrivateProfileStringA
GetEnvironmentStrings
LoadLibraryA
IsBadReadPtr
GetModuleFileNameA
LocalAlloc
MapViewOfFile
HeapDestroy
EnterCriticalSection
HeapSize
GetStdHandle
TlsAlloc
GetProcessTimes
GetCurrentThread
LoadLibraryExA
GetCurrentThreadId
CloseHandle
GetStringTypeA
OpenProcess
GetACP
ExitProcess
InterlockedDecrement
GetPrivateProfileSectionA
GetSystemDirectoryA
GetStringTypeW
HeapCreate
WriteProfileStringA
TlsGetValue
GetEnvironmentStringsW
ClearCommError
SetFilePointer
InterlockedExchange
CreateThread
FindResourceExA
GetProcAddress
InitializeCriticalSection
EnumResourceNamesW
lstrcmpiA
GetModuleHandleW
lstrcpynA
GetModuleFileNameW
CreateFileMappingA
MultiByteToWideChar
CreateDirectoryA
SetErrorMode
HeapReAlloc
WritePrivateProfileStringA
SetEvent
VirtualQuery
FreeLibrary
GetCPInfo
LoadResource
GetFileAttributesA
GetPrivateProfileIntA
VirtualAlloc
GetVersion
CreateEventA
ReadProcessMemory
InterlockedIncrement
RaiseException
IsBadWritePtr
SetLastError
LeaveCriticalSection
GetCommandLineA
SetUnhandledExceptionFilter
FreeEnvironmentStringsA
QueryPerformanceCounter
IsDBCSLeadByte
GetThreadLocale
RtlUnwind
lstrlenA
ReadFile
ExitProcess
VirtualFree
IsBadCodePtr
GetExitCodeProcess
FreeEnvironmentStringsW
lstrlenW
GetSystemInfo
WaitForSingleObject
GetCurrentProcess
VirtualProtect
GetPrivateProfileSectionNamesA
GetVersionExA
CreateFileA
SetHandleCount
HeapAlloc
GetProfileStringA
CompareStringA
lstrcatA
FlushFileBuffers
GetSystemTimeAsFileTime
ReleaseMutex
LCMapStringW
LockResource
TerminateThread
lstrcpyA
LoadLibraryW
WriteFile
GetStartupInfoA
FindFirstFileA
LocalFree
FindClose
InterlockedCompareExchange
GetOEMCP
UnhandledExceptionFilter
GetLocaleInfoA
SetStdHandle
CreateProcessW
TlsFree
LocalSize
FindResourceA
SetEndOfFile
HeapFree
Sections
.text Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rscr Size: 512B - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ