Static task
static1
Behavioral task
behavioral1
Sample
e9194b1cdab59db18a6c8ce152e3027b_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e9194b1cdab59db18a6c8ce152e3027b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e9194b1cdab59db18a6c8ce152e3027b_JaffaCakes118
-
Size
324KB
-
MD5
e9194b1cdab59db18a6c8ce152e3027b
-
SHA1
2e6be9fcee601b61b157c2e9af478bb904df18ea
-
SHA256
f50b0ab1b6d3e765745a1653f51ecdf1ea3a91a16433c01e06b9984cf403db26
-
SHA512
1eb0e1c6de0019d1f39059d97b971ed30182c0088744858670af210ea99c4c814435784a803b80fbf6e10161c49fd01fbc606f27dd09a33d3745cc256d05da5d
-
SSDEEP
6144:pvFoFlzU9AZQPshdOlG9LrfvFQ4XVM/WhE+7RtsbTGNZHHZ7X4ZoeusZI:lkowslG9n+4XVM/WO+7RqbTGNZHHZ7Xa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e9194b1cdab59db18a6c8ce152e3027b_JaffaCakes118
Files
-
e9194b1cdab59db18a6c8ce152e3027b_JaffaCakes118.exe windows:4 windows x86 arch:x86
e3ba65fb201f89b28698ce8b28fcc353
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpiW
lstrcpyW
CompareStringW
GetPrivateProfileStringW
GetCommandLineW
DeleteFileW
WritePrivateProfileStringA
RemoveDirectoryW
FileTimeToSystemTime
FileTimeToDosDateTime
FileTimeToLocalFileTime
SetFilePointer
GetFileInformationByHandle
GetFileType
MapViewOfFile
CreateFileMappingW
DuplicateHandle
WriteFile
UnmapViewOfFile
SystemTimeToFileTime
GetLocalTime
SetEndOfFile
GetLastError
FindClose
FindFirstFileW
SetFileTime
SetFileAttributesW
GetFileAttributesW
LockFile
UnlockFile
MultiByteToWideChar
IsBadWritePtr
IsBadReadPtr
CreateDirectoryW
InitializeCriticalSection
CopyFileW
GetModuleFileNameW
LocalFree
FormatMessageW
Sleep
WaitForSingleObject
TerminateProcess
GetCurrentProcessId
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceW
WTSGetActiveConsoleSessionId
lstrcpynW
GetVolumeInformationW
GetFullPathNameW
LocalFileTimeToFileTime
TerminateThread
GetPrivateProfileSectionW
DebugActiveProcess
DebugActiveProcessStop
ContinueDebugEvent
WaitForDebugEvent
GetTempPathW
GetThreadContext
ResumeThread
SuspendThread
OpenThread
CreateProcessW
DebugBreakProcess
GetStartupInfoW
DeleteCriticalSection
HeapDestroy
ExitProcess
FlushInstructionCache
OpenProcess
GetModuleHandleW
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
lstrlenA
OutputDebugStringW
CloseHandle
DebugBreak
GetCurrentThreadId
WideCharToMultiByte
CreateFileW
InterlockedDecrement
lstrlenW
InterlockedIncrement
GetFileSize
ReadFile
FindNextFileW
user32
ReleaseCapture
GetCapture
GetCursorPos
ScreenToClient
DestroyCursor
SetWindowPos
SetRectEmpty
DefWindowProcW
SetCapture
GetWindowRect
GetWindow
GetWindowLongW
GetParent
EndDialog
RegisterWindowMessageA
UpdateWindow
SendMessageW
CharLowerW
CharNextW
PostThreadMessageW
wvsprintfW
LoadStringW
IsDialogMessageW
SystemParametersInfoW
GetClientRect
MapWindowPoints
ShowWindow
DestroyWindow
CreateDialogParamW
GetClassNameW
EnumWindows
EnumChildWindows
FindWindowW
FindWindowExW
CharUpperW
GetForegroundWindow
SetTimer
SetDlgItemTextW
GetSystemMetrics
LoadImageW
GetDlgItem
CallWindowProcW
CreateWindowExW
IsWindowEnabled
GetSysColor
GetFocus
DrawFocusRect
FillRect
DrawTextW
ReleaseDC
CreateCursor
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetDC
OffsetRect
GetDlgCtrlID
BeginPaint
EndPaint
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
IsWindow
InvalidateRect
PtInRect
SetCursor
SetFocus
SetWindowLongW
gdi32
ExtTextOutW
CreateSolidBrush
SetBkMode
SetTextColor
DeleteDC
GetStockObject
GetObjectW
CreateFontIndirectW
SelectObject
GetBkColor
SetBkColor
DeleteObject
advapi32
RegCloseKey
DuplicateTokenEx
CreateProcessAsUserW
RegOpenKeyExW
RegQueryValueExW
shell32
ShellExecuteExW
SHGetPathFromIDListW
SHFileOperationW
ShellExecuteW
SHBrowseForFolderW
ole32
CoInitialize
CoUninitialize
ws2_32
gethostbyname
inet_ntoa
inet_addr
WSAStartup
WSAGetLastError
setsockopt
closesocket
shutdown
WSASetLastError
gethostname
WSACleanup
psapi
GetModuleBaseNameW
EnumProcesses
EnumProcessModules
GetModuleFileNameExW
shlwapi
PathRemoveFileSpecW
PathAddBackslashW
PathFileExistsW
PathFindFileNameW
winmm
sndPlaySoundW
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
msvcp60
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_Xlen@std@@YAXXZ
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??8std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBGI@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??0logic_error@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??_7out_of_range@std@@6B@
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
comctl32
InitCommonControlsEx
_TrackMouseEvent
msvcrt
wcschr
memmove
wcslen
iswspace
wcsstr
wcscmp
iswdigit
??2@YAPAXI@Z
_ftol
__CxxFrameHandler
wcsrchr
malloc
free
realloc
_wcsicmp
_purecall
mktime
strncpy
wcspbrk
time
gmtime
localtime
_wcslwr
wcscpy
vswprintf
swprintf
_waccess
toupper
swscanf
wcscat
strtol
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_CxxThrowException
_beginthreadex
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_tzset
__set_app_type
_except_handler3
??1type_info@@UAE@XZ
_controlfp
__dllonexit
_onexit
_stricmp
_wtoi
wininet
InternetOpenW
InternetConnectW
InternetCloseHandle
InternetWriteFile
HttpSendRequestExW
HttpAddRequestHeadersW
HttpOpenRequestW
mxhttprq
Init
CreateAsynHttpClient
SetAutoClose
Finalize
SetlocalPath
MxHttpRequestByCallBack
dbghelp
MiniDumpWriteDump
mxcrashcatch
Install
Uninstall
SelLanIniFile
netapi32
Netbios
Sections
.text Size: 112KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PACK Size: 144KB - Virtual size: 380KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE