Static task
static1
Behavioral task
behavioral1
Sample
fb25ae4ad306c725f65805a5860afbc2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fb25ae4ad306c725f65805a5860afbc2_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
fb25ae4ad306c725f65805a5860afbc2_JaffaCakes118
-
Size
348KB
-
MD5
fb25ae4ad306c725f65805a5860afbc2
-
SHA1
95f37a9897a9e87ebeac02af07dad74e065f5402
-
SHA256
ff643671b6b76520a3a2478674914bd64ff41c7de9021e77bdeeb78df2b4a807
-
SHA512
8f2e1467d576be29937bd58586b8e1678b68f17b51579610fc4d51aca8d80ae1491f3704a9f7459165197fec2b61b68a919e11477560aa9665fc4ac461d29eb7
-
SSDEEP
6144:9TXaPzWvU+vHkRBo1lY9djE7aQCzY6/4d2GOuSkvHCJ0nJFIARNeb9BDGkWi:6TAY9G7ao6MnOuSl6wNb9tGkn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb25ae4ad306c725f65805a5860afbc2_JaffaCakes118
Files
-
fb25ae4ad306c725f65805a5860afbc2_JaffaCakes118.exe windows:4 windows x86 arch:x86
4045b02b77be72092c0335f5026279fa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStartupInfoA
GetStringTypeA
Beep
FileTimeToLocalFileTime
GetModuleHandleA
user32
InvalidateRect
GetWindowTextA
DispatchMessageA
ScreenToClient
LoadBitmapA
IsCharAlphaW
SetClipboardData
CreateDialogIndirectParamW
PtInRect
MessageBeep
ValidateRect
IsWindow
MapVirtualKeyExW
CheckMenuItem
MapDialogRect
FindWindowExA
UnpackDDElParam
LoadMenuA
AppendMenuW
SetClassLongA
CallMsgFilterA
DestroyCaret
FindWindowExW
GetMenu
RemovePropA
DrawFrameControl
ShowOwnedPopups
DrawIcon
ShowCursor
GetClipboardViewer
ModifyMenuA
CharUpperW
MessageBoxA
EnumDisplaySettingsW
SetMenu
DdeQueryStringA
SetTimer
KillTimer
RegisterClassExW
DestroyAcceleratorTable
GetMessageExtraInfo
CloseClipboard
EnableScrollBar
GetForegroundWindow
GetFocus
GetWindow
GetParent
FindWindowA
IsWindowVisible
GetMessageA
AttachThreadInput
SendMessageA
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
EnumServicesStatusA
ReportEventA
SetFileSecurityW
RegCreateKeyA
ImpersonateSelf
CreateServiceA
SetSecurityDescriptorGroup
CreateProcessAsUserA
LogonUserA
StartServiceA
DeleteService
StartServiceCtrlDispatcherW
GetSidIdentifierAuthority
MakeAbsoluteSD
GetSidLengthRequired
SetSecurityDescriptorSacl
RegDeleteKeyA
RegisterServiceCtrlHandlerA
CreateServiceW
ChangeServiceConfig2W
RegRestoreKeyW
GetFileSecurityW
QueryServiceStatus
SetKernelObjectSecurity
GetKernelObjectSecurity
GetSidSubAuthorityCount
InitializeSid
ReportEventW
RegUnLoadKeyW
GetLengthSid
LsaFreeMemory
RegisterEventSourceA
RegOpenKeyExW
GetSidSubAuthority
RegConnectRegistryA
RegQueryValueW
RegOverridePredefKey
CloseServiceHandle
RegSetValueA
InitiateSystemShutdownA
ChangeServiceConfigA
AllocateAndInitializeSid
LsaOpenPolicy
RegEnumKeyExA
GetAclInformation
CopySid
RegSetValueExW
RegEnumKeyW
RevertToSelf
LockServiceDatabase
RegCloseKey
RegQueryInfoKeyA
LsaQueryInformationPolicy
ReadEventLogW
CreateProcessAsUserW
RegQueryInfoKeyW
RegOpenKeyExA
RegQueryValueA
RegCreateKeyW
RegSetValueExA
ChangeServiceConfigW
RegCreateKeyExW
AddAce
AdjustTokenPrivileges
RegCreateKeyExA
QueryServiceConfigW
RegNotifyChangeKeyValue
OpenThreadToken
msvcrt
_mbscat
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
malloc
__dllonexit
_onexit
abs
_logb
exit
_acmdln
__getmainargs
_initterm
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 545KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 228KB - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ