Static task
static1
Behavioral task
behavioral1
Sample
661f87ca199421a6376ffe641469bb46_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
661f87ca199421a6376ffe641469bb46_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
661f87ca199421a6376ffe641469bb46_JaffaCakes118
-
Size
106KB
-
MD5
661f87ca199421a6376ffe641469bb46
-
SHA1
d863732dfd69ac74dd81bd9057ca6fcd100020c2
-
SHA256
05a7023b3e94b02f8d181fcdbb8375893078f0ebdf7728a8914247bc74ee6fcb
-
SHA512
82e7a767660def5a6e343646d791615bdb3abfb9d787831d8b001c05ba366ca16d6ee5a01bbe3b335e374447fc7dd7f9094fe65ebc677fcd60ff6769bb6ec0e3
-
SSDEEP
3072:590TTDXp7IrNid/wWzdgqK5BcQiZkNtEbvmC:otIZc/hzdgqKxiK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 661f87ca199421a6376ffe641469bb46_JaffaCakes118
Files
-
661f87ca199421a6376ffe641469bb46_JaffaCakes118.exe windows:4 windows x86 arch:x86
bed39033589757d8683e75d86612f92a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathUnquoteSpacesW
PathFileExistsW
PathAddBackslashW
PathRemoveFileSpecW
PathRemoveBlanksW
SHCopyKeyW
PathIsRelativeW
PathIsDirectoryW
SHDeleteKeyW
advapi32
RegEnumValueW
RegEnumKeyExA
RegDeleteValueW
CryptHashData
RegQueryInfoKeyW
RegDeleteValueA
RegCreateKeyExW
CryptCreateHash
RegOpenKeyExW
RegFlushKey
CryptReleaseContext
CryptDestroyKey
CryptImportKey
CryptVerifySignatureA
CryptDestroyHash
RegCreateKeyExA
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExW
RegCloseKey
RegDeleteKeyA
CryptAcquireContextA
RegSetValueExW
RegDeleteKeyW
ddraw
DirectDrawCreate
DirectDrawEnumerateA
DirectDrawCreateEx
kernel32
GetUserDefaultUILanguage
QueryPerformanceCounter
SizeofResource
FormatMessageW
GetCurrentProcessId
lstrcmpiA
UnhandledExceptionFilter
GetModuleFileNameA
OpenProcess
GetUserDefaultLCID
WriteFile
GetCurrentThreadId
GetSystemDefaultLCID
VirtualAlloc
LoadLibraryExW
GetLastError
InterlockedCompareExchange
GetLocaleInfoA
FindResourceExA
SetEvent
VirtualFree
HeapFree
CopyFileW
TerminateProcess
GlobalFree
EnterCriticalSection
FindFirstFileW
GetStdHandle
LoadLibraryExA
OutputDebugStringW
GetFileAttributesW
GlobalAlloc
GetTickCount
Sleep
InterlockedIncrement
HeapReAlloc
IsDBCSLeadByte
LocalFree
ReleaseMutex
HeapAlloc
GetProcessVersion
DeleteCriticalSection
GetModuleFileNameW
GetFileSize
GetVersionExA
GetEnvironmentVariableA
WideCharToMultiByte
GetThreadLocale
AddAtomW
GetFileAttributesA
GetModuleHandleA
GetSystemTime
LockResource
ExitProcess
InterlockedDecrement
CreateDirectoryW
CreateMutexA
InitializeCriticalSection
MapViewOfFile
GetModuleHandleW
FindNextFileW
FindResourceA
SetUnhandledExceptionFilter
lstrcpynW
HeapSize
CreateProcessA
GetSystemTimeAsFileTime
GetStartupInfoA
GlobalUnlock
LoadLibraryA
LoadLibraryW
CreateEventA
FindClose
lstrlenA
GetProcessHeap
MultiByteToWideChar
CloseHandle
CreateFileW
WaitForSingleObject
GlobalLock
DuplicateHandle
DeleteAtom
GetProcAddress
InterlockedExchange
HeapDestroy
IsDebuggerPresent
GetACP
LeaveCriticalSection
MoveFileW
RaiseException
SetCurrentDirectoryW
ExpandEnvironmentStringsW
SystemTimeToFileTime
FindAtomW
CreateFileMappingW
UnmapViewOfFile
CreateFileMappingA
lstrlenW
GetCurrentDirectoryW
FreeLibrary
CreateProcessW
GetFileAttributesExW
LoadResource
SetFileAttributesW
user32
LoadIconA
SetForegroundWindow
CharNextA
CharNextW
MessageBoxW
UnregisterClassA
LoadBitmapA
LoadImageA
LoadStringW
GetSystemMetrics
shell32
SHCreateDirectoryExW
SHGetFolderPathW
SHFileOperationW
ole32
CoReleaseMarshalData
CoTaskMemAlloc
CoDisconnectObject
StringFromGUID2
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
CoInitializeSecurity
CoTaskMemFree
CoCreateInstance
StringFromCLSID
IIDFromString
CoMarshalInterface
CoTaskMemRealloc
gdi32
DeleteObject
Sections
.text Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ