D3D9GetDirect3DDevice
Static task
static1
Behavioral task
behavioral1
Sample
3ea8931fde3e6849e88dbf86bd08cf1a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3ea8931fde3e6849e88dbf86bd08cf1a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3ea8931fde3e6849e88dbf86bd08cf1a_JaffaCakes118
-
Size
81KB
-
MD5
3ea8931fde3e6849e88dbf86bd08cf1a
-
SHA1
b70c275487044cccbc0102c4405afb82cfe19dc8
-
SHA256
05ae0efa4d2b19ca14230dd89c4d4084dec63b5fc546ed66f7543e67832e5a2e
-
SHA512
2e452196078581048211596df78a0f9e9e62a760fc86abadd4d869c6742398b98affb89d011dbb87a4fdf4f49db02b4819b085207a84645c6d68bc374316efc6
-
SSDEEP
1536:hljdpAhoVS04BtRKLCrvfEd3pK9Pdn78froZxgHxQk+PicfXOL5KD6EUOphW:T8uV7SR0CrEd3Id78TagHxWPrXOUD6EW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ea8931fde3e6849e88dbf86bd08cf1a_JaffaCakes118
Files
-
3ea8931fde3e6849e88dbf86bd08cf1a_JaffaCakes118.exe windows:4 windows x86 arch:x86
6a7ebe4d30e4a3493d8a64fe686698c9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
AddAtomW
ChangeTimerQueueTimer
CloseHandle
CreateFileW
CreateMailslotW
DisableThreadLibraryCalls
EnumLanguageGroupLocalesA
ExitProcess
ExitThread
FindAtomW
GetCommandLineA
GetCurrentThreadId
GetFileSizeEx
GetLogicalDriveStringsA
GetModuleHandleA
GetPrivateProfileSectionNamesW
GetPrivateProfileStructA
GetStartupInfoA
GetStringTypeA
GetSystemDefaultLangID
GetTapePosition
GetTimeZoneInformation
GetVersionExA
GlobalGetAtomNameA
GlobalReAlloc
GlobalSize
HeapAlloc
HeapCreate
HeapDestroy
IsBadWritePtr
LoadLibraryA
LocalSize
MoveFileExW
MoveFileWithProgressA
OpenEventW
SetCalendarInfoW
SetFilePointerEx
SetProcessPriorityBoost
VerifyVersionInfoA
lstrcpynA
user32
CallWindowProcA
DeleteMenu
DialogBoxParamA
DrawMenuBar
EmptyClipboard
EndDialog
FindWindowA
GetMenuItemCount
GetSysColorBrush
GetWindow
GetWindowTextA
InvalidateRgn
IsDialogMessageA
IsZoomed
LoadCursorA
OffsetRect
OpenClipboard
PostMessageA
ScreenToClient
SetWindowPlacement
SetWindowTextA
UnionRect
WindowFromPoint
advapi32
StartTraceA
SetUserFileEncryptionKey
SetSecurityDescriptorOwner
RegQueryValueExA
RegOpenKeyW
RegOpenKeyExA
RegLoadKeyW
RegEnumKeyA
RegDeleteKeyW
ObjectPrivilegeAuditAlarmW
LsaSetTrustedDomainInformation
LsaSetDomainInformationPolicy
LsaRemovePrivilegesFromAccount
LsaCreateTrustedDomainEx
LsaClose
GetTrusteeNameA
GetSidLengthRequired
GetSecurityInfoExW
GetNamedSecurityInfoA
FreeSid
EnumServicesStatusExA
ElfClearEventLogFileA
CryptGetKeyParam
AddAuditAccessAceEx
AdjustTokenGroups
CheckTokenMembership
CloseEncryptedFileRaw
CloseTrace
ConvertSidToStringSidA
ConvertStringSDToSDRootDomainW
olepro32
OleCreatePropertyFrame
oleacc
GetRoleTextA
AccessibleObjectFromEvent
AccessibleChildren
security
ImportSecurityContextA
AddSecurityPackageW
QuerySecurityContextToken
QuerySecurityPackageInfoA
comctl32
ImageList_GetDragImage
FlatSB_SetScrollProp
CreatePropertySheetPageA
ImageList_Add
ImageList_Copy
ImageList_Destroy
ImageList_DragShowNolock
FlatSB_SetScrollRange
ImageList_GetImageRect
ImageList_SetIconSize
LBItemFromPt
MenuHelp
PropertySheetW
oledlg
OleUIConvertA
OleUIEditLinksA
OleUIChangeSourceA
OleUIBusyA
comdlg32
dwLBSubclass
ReplaceTextW
PrintDlgW
PrintDlgExW
GetSaveFileNameA
PrintDlgA
ReplaceTextA
Exports
Exports
Sections
.text Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ