Static task
static1
Behavioral task
behavioral1
Sample
ec6e4426bb393dee63577fd5028ad00b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ec6e4426bb393dee63577fd5028ad00b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ec6e4426bb393dee63577fd5028ad00b_JaffaCakes118
-
Size
697KB
-
MD5
ec6e4426bb393dee63577fd5028ad00b
-
SHA1
b9b19943ff008d4b44ffd153636fc5da569b674f
-
SHA256
23a964a566c8a4e2cab5da68df811200f936a73347c510aaa71029b4357c46d0
-
SHA512
e265b270f6d1bf1f5e5a5174e7c08b7eb75444fd19ebe12120d5bb9ecab339018bcc6ba3580c5b02e80764efcbbf964c11350d0ae89074b051f49bb4932a5767
-
SSDEEP
6144:2rcihvKU0a5mcYdoo5Yf6NdEdfy0WEUWwvkL8L3ME4uamALNaACoV9AVYBX+0dyf:2YiAUBx6/EdKWaDajMYuDeK8ci6aWz
Malware Config
Signatures
Files
-
ec6e4426bb393dee63577fd5028ad00b_JaffaCakes118.exe windows:4 windows x86 arch:x86
5452a94adc21d5edb872aff57ecd6419
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01-08-1996 00:00Not After31-12-2020 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06-08-2003 00:00Not After05-08-2013 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:ddCertificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before22-10-2008 00:00Not After23-11-2010 23:59SubjectCN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathRemoveFileSpecW
PathIsRootW
PathFindFileNameW
SHGetValueW
PathFileExistsW
PathCombineW
wvnsprintfW
StrStrIW
PathIsDirectoryW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetExitCodeThread
ResumeThread
FindNextFileW
SetLastError
GetFullPathNameW
FindFirstFileW
FindClose
GetCommandLineW
lstrcpyW
FlushInstructionCache
GetCurrentProcess
FlushFileBuffers
WriteFile
ReadFile
GetFileSize
CreateFileW
FreeResource
GlobalUnlock
LockResource
SizeofResource
LoadResource
FindResourceW
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
CreateMutexW
GetLastError
DebugBreak
OutputDebugStringW
lstrlenA
GetProcAddress
GetModuleHandleW
GetVersionExW
GlobalFree
GlobalLock
GlobalAlloc
GetFileSizeEx
GetPrivateProfileIntW
GetPrivateProfileStringW
GetTickCount
CloseHandle
GetFileAttributesExW
TerminateProcess
GetSystemDirectoryW
CopyFileW
MultiByteToWideChar
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
LoadLibraryW
FreeLibrary
WideCharToMultiByte
GetVersion
MulDiv
WritePrivateProfileStringW
GetModuleFileNameW
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
TlsSetValue
TlsGetValue
TlsAlloc
GetLongPathNameW
GetSystemTime
GetFileType
QueryPerformanceCounter
ResetEvent
GetLocalTime
InterlockedExchangeAdd
CreateWaitableTimerW
SetWaitableTimer
CreateSemaphoreW
MoveFileW
SetEndOfFile
GetThreadTimes
WaitForMultipleObjects
ReleaseSemaphore
ReleaseMutex
GetCurrentThread
SetFilePointer
VirtualAlloc
VirtualFree
LocalFree
InterlockedIncrement
lstrlenW
GetTempPathW
GetCurrentProcessId
GetTempFileNameW
RemoveDirectoryW
SetErrorMode
SetUnhandledExceptionFilter
Sleep
DeleteFileW
InterlockedDecrement
FormatMessageW
HeapFree
TlsFree
SetEnvironmentVariableW
HeapAlloc
GetProcessHeap
GetEnvironmentVariableW
OpenThread
GetStartupInfoW
GetExitCodeProcess
user32
SetWindowPos
EndDialog
DefWindowProcW
DestroyWindow
SetWindowLongW
PostMessageW
MapWindowPoints
GetClientRect
SystemParametersInfoW
SendMessageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SetForegroundWindow
ShowWindow
GetActiveWindow
DialogBoxParamW
LoadStringW
MessageBoxW
CallNextHookEx
UnhookWindowsHookEx
CheckDlgButton
BeginPaint
EndPaint
SetCursor
GetSysColor
GetDC
ReleaseDC
GetWindowTextW
InflateRect
GetScrollInfo
MoveWindow
GetScrollRange
GetScrollPos
SetScrollPos
SetFocus
SetScrollInfo
ShowScrollBar
GetCursorPos
ScreenToClient
DrawTextW
GetSystemMenu
EnableMenuItem
DestroyMenu
GetWindowPlacement
BringWindowToTop
LoadIconW
UpdateWindow
PostQuitMessage
IsDialogMessageW
KillTimer
SetTimer
CreateWindowExW
CallWindowProcW
InvalidateRect
RedrawWindow
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
IsWindow
IsWindowVisible
IsIconic
ExitWindowsEx
EnableWindow
OffsetRect
GetDlgItem
PtInRect
CopyRect
CharLowerW
SetDlgItemTextW
CharUpperW
CharNextW
wvsprintfW
GetSystemMetrics
LoadImageW
SetWindowTextW
GetParent
GetWindowLongW
GetWindow
SetWindowsHookExW
IsDlgButtonChecked
GetDlgItemTextW
CreateDialogParamW
GetWindowRect
gdi32
SetBkColor
BitBlt
CreateCompatibleBitmap
ExtTextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
SelectObject
SetTextColor
DeleteObject
GetDeviceCaps
CreateFontIndirectW
advapi32
RegQueryValueExW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegDeleteKeyW
RegCloseKey
shell32
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHBrowseForFolderW
Shell_NotifyIconW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
ShellExecuteExW
ShellExecuteW
ole32
CreateStreamOnHGlobal
CLSIDFromProgID
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
OleRun
oleaut32
VariantClear
SysAllocString
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
VariantInit
VariantChangeType
GetErrorInfo
SysFreeString
OleLoadPicture
comctl32
InitCommonControlsEx
msimg32
TransparentBlt
msvcp60
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Xran@std@@YAXXZ
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_Xlen@std@@YAXXZ
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
??0_Lockit@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z
?nothrow@std@@3Unothrow_t@1@B
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??1_Lockit@std@@QAE@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
ws2_32
htons
htonl
ntohl
WSAStartup
inet_addr
inet_ntoa
gethostbyname
gethostname
WSACleanup
WSASetLastError
WSAAsyncSelect
bind
socket
connect
WSAGetLastError
closesocket
setsockopt
send
recv
ntohs
ioctlsocket
accept
listen
shutdown
getpeername
sendto
recvfrom
WSACancelAsyncRequest
WSAAsyncGetHostByName
setupapi
SetupIterateCabinetW
wininet
HttpQueryInfoW
InternetErrorDlg
InternetOpenUrlW
InternetOpenW
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCloseHandle
msvcrt
fclose
_wcsicmp
wcsncmp
_wcsnicmp
printf
exit
malloc
wcscmp
_wtoi
iswdigit
time
srand
rand
wcsstr
memmove
realloc
free
fread
_wfopen
_ftol
wcscat
_purecall
wprintf
fwrite
__RTDynamicCast
iswspace
isdigit
_CxxThrowException
_except_handler3
_endthread
_wremove
_wstat
_CIpow
toupper
setlocale
fflush
fwprintf
_vsnprintf
fprintf
ctime
sprintf
atoi
_vsnwprintf
_endthreadex
strncpy
strtol
strchr
_wtoi64
memchr
_strnicmp
isspace
_atoi64
_callnewh
_errno
wcstok
strerror
wcschr
swscanf
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_exit
_XcptFilter
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wcsupr
_itoa
strncmp
swprintf
wcsrchr
wcscpy
_snwprintf
wcslen
_beginthreadex
wcsncat
wcsncpy
__CxxFrameHandler
??2@YAPAXI@Z
psapi
GetModuleFileNameExW
EnumProcessModules
iphlpapi
GetNetworkParams
GetAdaptersInfo
secur32
InitializeSecurityContextA
AcquireCredentialsHandleA
FreeCredentialsHandle
winhttp
WinHttpGetIEProxyConfigForCurrentUser
Sections
.text Size: 544KB - Virtual size: 543KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ