Static task
static1
Behavioral task
behavioral1
Sample
fa7024834ef359cb41ad4a0aac01523b_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fa7024834ef359cb41ad4a0aac01523b_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fa7024834ef359cb41ad4a0aac01523b_JaffaCakes118
-
Size
860KB
-
MD5
fa7024834ef359cb41ad4a0aac01523b
-
SHA1
09a8da6437b058637b87a9972f911dd7f8267061
-
SHA256
75fb234b1e41eb3696a17cef8421e3de8d5a93216722b158d7324c42fe85df53
-
SHA512
cbe5a108199dda82ffa1a3fa1d650a5205efca0afa83eb426678d39f3afc4e45b5812b2dc9286e9bb9f99e2a03eb0808d5c93becae0d0553c41aeaae04f5bea3
-
SSDEEP
24576:Hf7DEt8Iw+2GzaInxjeBMjx0NOAbNWWG/uF1:vszaInx6OaFb2a
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa7024834ef359cb41ad4a0aac01523b_JaffaCakes118
Files
-
fa7024834ef359cb41ad4a0aac01523b_JaffaCakes118.exe windows:5 windows x86 arch:x86
6300bca3082312d7a15e1549e323e3ed
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
security
DecryptMessage
CompleteAuthToken
DeleteSecurityPackageW
QueryCredentialsAttributesA
ExportSecurityContext
ApplyControlToken
UnsealMessage
EncryptMessage
AcquireCredentialsHandleW
QueryCredentialsAttributesW
QuerySecurityPackageInfoA
AddSecurityPackageA
InitializeSecurityContextA
EnumerateSecurityPackagesW
ImportSecurityContextA
ImpersonateSecurityContext
SealMessage
FreeCredentialsHandle
InitializeSecurityContextW
AcceptSecurityContext
AcquireCredentialsHandleA
InitSecurityInterfaceA
QuerySecurityPackageInfoW
VerifySignature
DeleteSecurityContext
QueryContextAttributesA
RevertSecurityContext
QuerySecurityContextToken
EnumerateSecurityPackagesA
FreeContextBuffer
AddSecurityPackageW
netapi32
DsRoleAbortDownlevelServerUpgrade
NetDfsAddFtRoot
RxNetUserPasswordSet
NetApiBufferFree
I_NetGetDCList
NetGroupSetInfo
NetQueryDisplayInformation
NetpAddTlnFtinfoEntry
NetLocalGroupAdd
NetDfsAddStdRootForced
NetSessionDel
NetLocalGroupSetMembers
NetGetAnyDCName
NetWkstaTransportDel
NetReplExportDirUnlock
NetServerComputerNameDel
NetMessageNameEnum
I_NetDfsGetVersion
NetapipBufferAllocate
I_BrowserQueryEmulatedDomains
I_BrowserSetNetlogonState
NetErrorLogRead
I_NetLogonUasLogon
NetShareSetInfo
NetpOpenConfigData
NetLocalGroupGetInfo
NetpGetConfigValue
DsValidateSubnetNameA
I_NetServerPasswordSet2
DsRoleServerSaveStateForUpgrade
NlBindingSetAuthInfo
NetGroupGetInfo
NetpGetConfigBool
NetLocalGroupGetMembers
DsRoleCancel
DsRoleGetDatabaseFacts
I_NetServerPasswordGet
NetRemoveAlternateComputerName
NetScheduleJobDel
I_BrowserDebugCall
NetpAssertFailed
I_NetlogonComputeClientDigest
NetServiceEnum
I_NetAccountDeltas
DsGetDcNameW
kernel32
GetLongPathNameA
SetFilePointerEx
GetPriorityClass
BaseUpdateAppcompatCache
LoadLibraryA
UnmapViewOfFile
SetFilePointer
ReadFileEx
GetProfileStringA
SetConsoleIcon
ExitVDM
SetMessageWaitingIndicator
QueryInformationJobObject
GlobalFree
QueueUserAPC
QueryMemoryResourceNotification
FormatMessageA
QueryPerformanceCounter
DeleteCriticalSection
Toolhelp32ReadProcessMemory
FindActCtxSectionGuid
MulDiv
VirtualAlloc
LCMapStringW
GlobalFindAtomW
GetConsoleHardwareState
GetOEMCP
lstrcpyA
SetCurrentDirectoryW
UTUnRegister
SetCurrentDirectoryA
HeapSize
UTRegister
GetProcAddress
lstrcmpiA
ntdll
PfxFindPrefix
NtOpenTimer
_CIsin
ZwNotifyChangeDirectoryFile
RtlSetProcessIsCritical
RtlUnicodeStringToOemString
_lfind
NtQueryInformationProcess
RtlInitializeSid
RtlFreeThreadActivationContextStack
NtSystemDebugControl
RtlResetRtlTranslations
RtlFindClearBits
RtlNtStatusToDosError
isxdigit
LdrSetDllManifestProber
ZwCloseObjectAuditAlarm
PfxRemovePrefix
iswdigit
NtOpenEvent
RtlRunEncodeUnicodeString
ZwDelayExecution
RtlValidateUnicodeString
ZwWaitForMultipleObjects
RtlAddVectoredExceptionHandler
RtlTraceDatabaseCreate
NtReadVirtualMemory
NtStopProfile
NtReadRequestData
NtOpenSemaphore
ZwUnmapViewOfSection
RtlGetCallersAddress
NtExtendSection
RtlEmptyAtomTable
RtlInitCodePageTable
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
ZwFsControlFile
_strnicmp
NtQueryTimerResolution
wininet
FtpRenameFileA
InternetSetCookieExW
FreeUrlCacheSpaceW
FtpGetFileSize
HttpSendRequestExA
HttpOpenRequestW
GopherOpenFileA
SetUrlCacheConfigInfoA
InternetCreateUrlW
RunOnceUrlCache
ResumeSuspendedDownload
UpdateUrlCacheContentPath
InternetCanonicalizeUrlA
ShowX509EncodedCertificate
InternetSetOptionExW
InternetAutodialHangup
FtpGetFileW
InternetAttemptConnect
HttpCheckDavCompliance
InternetAlgIdToStringW
InternetSetCookieW
InternetFortezzaCommand
InternetGoOnlineA
DeleteUrlCacheGroup
SetUrlCacheEntryInfoA
InternetQueryOptionA
IsUrlCacheEntryExpiredW
InternetConfirmZoneCrossing
FtpPutFileW
ParseX509EncodedCertificateForListBoxEntry
msdart
?IsWriteLocked@CLKRLinearHashTable@@QBE_NXZ
?GetDefaultSpinCount@CSmallSpinLock@@SGGXZ
?IsLocked@CLockedDoubleList@@QBE_NXZ
?ReadLock@CFakeLock@@QAEXXZ
?TryWriteLock@CReaderWriterLock2@@QAE_NXZ
?Unlock@CLockedSingleList@@QAEXXZ
?MpHeapCompact@@YAKPAX@Z
?_Contract@CLKRLinearHashTable@@AAE?AW4LK_RETCODE@@XZ
?GetSpinCount@CSmallSpinLock@@QBEGXZ
?ConvertSharedToExclusive@CReaderWriterLock@@QAEXXZ
?SetDefaultSpinCount@CReaderWriterLock3@@SGXG@Z
?First@CDoubleList@@QBEQAVCListEntry@@XZ
?ValidSignature@CLKRHashTable@@QBE_NXZ
?IsEmpty@CSingleList@@QBE_NXZ
?Last@CLockedDoubleList@@QAEQAVCListEntry@@XZ
?Apply@CLKRLinearHashTable@@QAEKP6G?AW4LK_ACTION@@PBXPAX@Z1W4LK_LOCKTYPE@@@Z
?sm_pfnTryEnterCriticalSection@CCriticalSection@@0P6GHPAU_RTL_CRITICAL_SECTION@@@ZA
?SetSpinCount@CSpinLock@@QAE_NG@Z
_DllMain@12
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock3@@SGNXZ
?SetDefaultSpinCount@CSmallSpinLock@@SGXG@Z
?GetStatistics@CLKRHashTable@@QBE?AVCLKRHashTableStats@@XZ
?_WriteLockSpin@CReaderWriterLock2@@AAEXXZ
?Lock@CLockedSingleList@@QAEXXZ
?IsWriteLocked@CLKRHashTable@@QBE_NXZ
?NumSubTables@CLKRHashTable@@QBEHXZ
?SetSpinCount@CReaderWriterLock3@@QAE_NG@Z
?IsWriteLocked@CFakeLock@@QBE_NXZ
?CreateHolder@@YGJPAUIGPDispenser@@HIPAPAUIGPHolder@@@Z
?ReadLock@CSpinLock@@QAEXXZ
?ReadLock@CSmallSpinLock@@QAEXXZ
?IsUsable@CLKRLinearHashTable@@QBE_NXZ
?IsWinNt4orLater@CMdVersionInfo@@SAHXZ
?BucketSizes@CLKRHashTableStats@@SGPBJXZ
?TryWriteLock@CReaderWriterLock@@QAE_NXZ
?ReadOrWriteUnlock@CFakeLock@@QAEX_N@Z
?SetSpinCount@CReaderWriterLock2@@QAE_NG@Z
??4CFakeLock@@QAEAAV0@ABV0@@Z
??1CLKRLinearHashTable@@QAE@XZ
Sections
.text Size: 338KB - Virtual size: 338KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 353KB - Virtual size: 353KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 165KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ