Static task
static1
Behavioral task
behavioral1
Sample
543ad292e985f1e2447f04ab04e20aab_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
543ad292e985f1e2447f04ab04e20aab_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
543ad292e985f1e2447f04ab04e20aab_JaffaCakes118
-
Size
184KB
-
MD5
543ad292e985f1e2447f04ab04e20aab
-
SHA1
223cd2caf640d531b03e969b46b7db47f053c52a
-
SHA256
c5d50406bcf8e1d21fdfed69be59e78628ac3446933ea026c2bff96d8d1bfd7c
-
SHA512
e1b9411d2c83aa3a84ec1354f3382dc091025a59a277b7b4837f030db8d8817a003b05de9a5eae5be7e2f11bc3393bd4149880f7f4084820fcbde10cea4b67d9
-
SSDEEP
3072:puXZ2gajDVqjJCWVOUJUSS4RSIFqQ7KaY+MM6H0k65ACCgyfhJBr1:pup2nqUUJpS4RSIfvY+MBwAdgAJBr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 543ad292e985f1e2447f04ab04e20aab_JaffaCakes118
Files
-
543ad292e985f1e2447f04ab04e20aab_JaffaCakes118.exe windows:5 windows x86 arch:x86
6d46f01a32541910551d632a7c465d63
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
FindNextFileW
VirtualProtect
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
SetFileAttributesW
CreateThread
InitializeCriticalSection
FileTimeToDosDateTime
EnterCriticalSection
GetTimeZoneInformation
MoveFileExW
GetUserDefaultUILanguage
GetPrivateProfileStringW
GetPrivateProfileIntW
GetCurrentThreadId
TlsGetValue
TlsSetValue
TerminateProcess
GetDriveTypeW
GetDiskFreeSpaceExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
lstrcmpiA
GetThreadContext
SetThreadContext
GetProcessId
WTSGetActiveConsoleSessionId
GlobalLock
GlobalUnlock
GetEnvironmentVariableW
SetThreadPriority
GetCurrentThread
ReadFile
Thread32Next
GetFileAttributesW
HeapCreate
HeapDestroy
ReadProcessMemory
LoadLibraryW
WideCharToMultiByte
Thread32First
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
GetTickCount
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
ResetEvent
GetTempFileNameW
ExpandEnvironmentStringsW
GetNativeSystemInfo
ReleaseMutex
WriteProcessMemory
GetSystemTime
LocalFree
GetCurrentProcessId
DuplicateHandle
OpenEventW
GetFileAttributesExW
lstrcmpiW
WaitForMultipleObjects
CreateEventW
GetProcAddress
GetModuleFileNameW
GetVersionExW
Sleep
VirtualFree
GetModuleHandleW
SetEvent
GetComputerNameW
SetErrorMode
GetCommandLineW
ExitProcess
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
VirtualFreeEx
OpenProcess
CreateRemoteThread
LeaveCriticalSection
WaitForSingleObject
user32
ReleaseCapture
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
DestroyWindow
UnregisterClassW
CreateWindowExW
RegisterClassW
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
GetWindowInfo
DrawEdge
BeginPaint
GetUpdateRect
IntersectRect
IsWindow
PostThreadMessageW
EqualRect
PrintWindow
SendMessageW
DefWindowProcW
IsRectEmpty
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
SwitchDesktop
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
SetWindowPos
PeekMessageA
GetAncestor
DefMDIChildProcW
GetKeyboardState
ToUnicode
CharLowerBuffA
GetClipboardData
SetWindowTextW
RegisterClassExA
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
MenuItemFromPoint
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
DefDlgProcA
DefMDIChildProcA
GetCapture
DefWindowProcA
GetDCEx
SetCursorPos
CallWindowProcA
EndMenu
CallWindowProcW
PostMessageW
MapVirtualKeyW
ExitWindowsEx
GetSystemMetrics
DispatchMessageW
GetWindow
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
SendInput
GetParent
GetForegroundWindow
InvalidateRect
DrawIcon
GetIconInfo
GetCursorPos
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetDC
DefFrameProcW
RegisterClassA
GetShellWindow
CharLowerW
GetMessageA
GetWindowRect
SetCapture
GetClassLongW
CloseWindowStation
SendMessageTimeoutW
SetWindowLongW
CharUpperW
ReleaseDC
PeekMessageW
CharLowerA
GetWindowLongW
TranslateMessage
HiliteMenuItem
advapi32
GetLengthSid
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
CryptVerifySignatureW
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptImportKey
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
CryptDestroyKey
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
RegEnumKeyExW
EqualSid
InitiateSystemShutdownExW
ConvertSidToStringSidW
IsWellKnownSid
CryptGetHashParam
shlwapi
UrlUnescapeA
PathRemoveBackslashW
StrCmpNIW
PathGetDriveNumberW
PathBuildRootW
StrStrIW
StrStrIA
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
PathQuoteSpacesW
PathIsURLW
PathRenameExtensionW
shell32
ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW
secur32
GetUserNameExW
ole32
StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx
gdi32
GetDeviceCaps
SetViewportOrgEx
CreateCompatibleBitmap
DeleteDC
GdiFlush
SetRectRgn
CreateCompatibleDC
SaveDC
RestoreDC
CreateDIBSection
GetDIBits
SelectObject
DeleteObject
ws2_32
bind
recv
setsockopt
shutdown
getsockname
select
getaddrinfo
WSAStartup
getpeername
recvfrom
sendto
WSARecv
WSASend
WSAEventSelect
WSAIoctl
connect
socket
freeaddrinfo
WSASetLastError
closesocket
send
listen
accept
WSAGetLastError
crypt32
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData
PFXExportCertStoreEx
wininet
InternetSetCookieA
HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
InternetSetStatusCallbackA
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
HttpQueryInfoA
InternetConnectA
InternetQueryOptionW
InternetCrackUrlA
InternetReadFile
oleaut32
VariantInit
SysAllocString
VariantClear
SysFreeString
netapi32
NetApiBufferFree
NetUserEnum
NetUserGetInfo
mpr
WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum
Sections
.text Size: 157KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ