Static task
static1
Behavioral task
behavioral1
Sample
4c2bf873680a8b3a7683402c4e927454_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4c2bf873680a8b3a7683402c4e927454_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
4c2bf873680a8b3a7683402c4e927454_JaffaCakes118
-
Size
914KB
-
MD5
4c2bf873680a8b3a7683402c4e927454
-
SHA1
3c18a1acbc8be3de0caa9b6fa1025cf58f7b71c5
-
SHA256
7f574eccc7ab5287fa1cb3c0e35fe819388a9a0f73bd2243f977d2f2175772e0
-
SHA512
ffe25102078df09de4fce6feb84a5b927f8b172903a1f03f415b65927635a058acb312d73887ee1221f7e93848134518f5bd625dbcda8c469b782784b96f2e9e
-
SSDEEP
12288:IHw5jSoveo/+YqiMXIRfm5PgAoB4TqEmvyhhUvogdpMi74zxLqo7t:ow5tvMv0fmJuKOsUvoapkd+ox
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c2bf873680a8b3a7683402c4e927454_JaffaCakes118
Files
-
4c2bf873680a8b3a7683402c4e927454_JaffaCakes118.exe windows:5 windows x86 arch:x86
4b187c8ee42322f66087556f1696c13f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReadFile
MapUserPhysicalPagesScatter
GetNumberFormatA
GetTapeStatus
GetCurrentThread
MultiByteToWideChar
SetLocaleInfoW
QueryInformationJobObject
OpenJobObjectA
GetPrivateProfileSectionNamesA
CreateFileMappingW
GetProfileSectionW
GetNamedPipeHandleStateA
GetAtomNameW
SetCalendarInfoW
GetNamedPipeHandleStateW
GetLocaleInfoA
SetWaitableTimer
SetVolumeMountPointA
GetWindowsDirectoryW
GetDateFormatA
GetSystemWindowsDirectoryA
ProcessIdToSessionId
CopyFileA
CreateJobObjectW
FindFirstFileExA
GetCurrencyFormatA
SetProcessAffinityMask
DefineDosDeviceW
SetTapeParameters
GetPrivateProfileStructW
GetEnvironmentStrings
VerifyVersionInfoW
CreateFileMappingA
AreFileApisANSI
SetConsoleTextAttribute
GetProcessAffinityMask
GetCompressedFileSizeA
DosDateTimeToFileTime
GetMailslotInfo
ReadDirectoryChangesW
PostQueuedCompletionStatus
GetPrivateProfileSectionNamesW
CreateWaitableTimerW
SetMailslotInfo
GetLogicalDriveStringsA
GetThreadContext
AddAtomW
GetConsoleAliasA
Module32NextW
GetConsoleAliasExesW
GetUserDefaultLangID
GetCPInfo
CreateNamedPipeA
FlushConsoleInputBuffer
ReplaceFileW
DeleteVolumeMountPointA
GetProfileStringA
OpenSemaphoreW
GetLogicalDriveStringsW
CreateSemaphoreW
GetProcessWorkingSetSize
EnumCalendarInfoW
OpenSemaphoreA
GetConsoleAliasExesA
ResetWriteWatch
OpenEventA
GetLocaleInfoW
GetCalendarInfoA
PrepareTape
GetDiskFreeSpaceExW
CopyFileExW
DeleteTimerQueue
CreateFileW
GetDiskFreeSpaceExA
GetProcessIoCounters
Module32FirstW
GetStringTypeA
MoveFileWithProgressW
FindFirstVolumeW
GetModuleFileNameA
FlushInstructionCache
GetTempPathA
GetSystemDirectoryW
GetTempPathW
GetFileAttributesW
SetInformationJobObject
ResetEvent
GetConsoleAliasExesLengthW
GetModuleFileNameW
GetTimeFormatA
GetStdHandle
SetComputerNameExW
SetFileAttributesA
SetConsoleDisplayMode
OpenJobObjectW
GetConsoleAliasW
GetVersion
GetPrivateProfileSectionW
GetModuleHandleW
FormatMessageW
GetBinaryTypeW
GetSystemDefaultLangID
CopyFileExA
OpenMutexA
GetSystemWindowsDirectoryW
GetConsoleWindow
OpenMutexW
ContinueDebugEvent
GetProcessPriorityBoost
EnumCalendarInfoA
FreeConsole
CreateToolhelp32Snapshot
SetFileTime
OpenEventW
CreateMutexA
CreateDirectoryA
AssignProcessToJobObject
GetSystemDefaultLCID
CreateEventA
CreateSemaphoreA
GetNumberFormatW
FindResourceExA
SetProcessPriorityBoost
CreateHardLinkW
LoadResource
SetEvent
GetCompressedFileSizeW
GetEnvironmentVariableA
GetProfileStringW
SetNamedPipeHandleState
GetAtomNameA
FlushFileBuffers
GetConsoleAliasesW
DefineDosDeviceA
MapViewOfFile
GetDevicePowerState
GetProfileSectionA
GetUserDefaultLCID
GetFileAttributesExW
GetDriveTypeW
GetFileTime
GetVolumeInformationW
GetEnvironmentVariableW
GetPrivateProfileStructA
GetProcessTimes
GetOEMCP
SetThreadContext
GetPriorityClass
SetFileAttributesW
SetConsoleCP
FreeUserPhysicalPages
GetConsoleCP
GetUserDefaultUILanguage
SetThreadAffinityMask
GetCalendarInfoW
LCMapStringA
SetPriorityClass
FlushViewOfFile
GetProcessVersion
GetDriveTypeA
CreateHardLinkA
OpenProcess
GetShortPathNameW
GetProfileIntA
CreateIoCompletionPort
CreateMailslotW
AddAtomA
GetTimeFormatW
GetVolumeNameForVolumeMountPointA
DeleteTimerQueueTimer
FoldStringA
SetThreadIdealProcessor
CreateTapePartition
GetFileAttributesA
GetNamedPipeInfo
GetBinaryTypeA
GetACP
SwitchToThread
FindFirstVolumeA
GetConsoleAliasesA
GetLogicalDrives
CreateJobObjectA
FindResourceW
GetStringTypeExW
FormatMessageA
ChangeTimerQueueTimer
ReleaseMutex
SetTapePosition
IsDBCSLeadByteEx
GetCPInfoExW
PeekNamedPipe
SetThreadLocale
SetSystemTimeAdjustment
GetFileSize
SetProcessWorkingSetSize
GetFullPathNameW
GetLongPathNameW
GetPrivateProfileIntA
GetFileAttributesExA
GetDiskFreeSpaceW
MoveFileWithProgressA
GetShortPathNameA
Toolhelp32ReadProcessMemory
SetLocaleInfoA
GetFullPathNameA
Module32Next
GetCPInfoExA
GetCurrentConsoleFont
GetThreadTimes
DnsHostnameToComputerNameW
SetConsoleCtrlHandler
SetCalendarInfoA
FindFirstFileA
SetConsoleActiveScreenBuffer
DeleteTimerQueueEx
GetThreadPriority
FindResourceA
FindNextChangeNotification
SetUnhandledExceptionFilter
CompareStringW
GetStringTypeW
SetConsoleOutputCP
GetPrivateProfileStringW
GetCurrentDirectoryA
EraseTape
GetConsoleOutputCP
SetComputerNameExA
GetWindowsDirectoryA
WideCharToMultiByte
GetConsoleCursorInfo
GetProfileIntW
EnumCalendarInfoExW
ConvertThreadToFiber
OpenFileMappingA
IsSystemResumeAutomatic
SetConsoleMode
GetModuleHandleA
ConvertDefaultLocale
GetConsoleScreenBufferInfo
GetDiskFreeSpaceA
SetThreadPriorityBoost
CreateDirectoryW
GetPrivateProfileIntW
GetConsoleAliasExesLengthA
LCMapStringW
VirtualAlloc
GetLongPathNameA
SetThreadExecutionState
GetNumberOfConsoleInputEvents
GetFileType
GetCurrencyFormatW
DuplicateHandle
CreateMutexW
ExpandEnvironmentStringsA
CancelWaitableTimer
CreateEventW
HeapReAlloc
HeapAlloc
Module32First
BindIoCompletionCallback
GetProcAddress
DeleteAtom
OpenThread
DnsHostnameToComputerNameA
SetStdHandle
CreateTimerQueue
GetPrivateProfileStringA
ReplaceFileA
FindVolumeMountPointClose
CompareStringA
SetEndOfFile
CreateDirectoryExA
OpenFileMappingW
SetEnvironmentVariableA
GetSystemDefaultUILanguage
VerSetConditionMask
GetPrivateProfileSectionA
DeviceIoControl
GetStringTypeExA
GetThreadLocale
FindResourceExW
CreateMailslotA
OpenWaitableTimerW
GetCurrentProcess
CancelIo
OpenWaitableTimerA
FindVolumeClose
FreeEnvironmentStringsA
GetFileInformationByHandle
FindAtomW
IsValidCodePage
SetCurrentDirectoryA
GetHandleInformation
MapUserPhysicalPages
GetVolumePathNameA
SearchPathA
GetVolumePathNameW
GetDateFormatW
DisconnectNamedPipe
ReadProcessMemory
FoldStringW
MapViewOfFileEx
GetFileSizeEx
CreateDirectoryExW
GetVolumeInformationA
SetSystemPowerState
CopyFileW
SetHandleInformation
FreeEnvironmentStringsW
FindAtomA
CreateWaitableTimerA
ReleaseSemaphore
ExpandEnvironmentStringsW
GetSystemDirectoryA
SetErrorMode
GetConsoleMode
SetCurrentDirectoryW
SetThreadPriority
CreateNamedPipeW
EnumCalendarInfoExA
GetCommandLineA
HeapSetInformation
ExitProcess
DecodePointer
WriteFile
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
HeapFree
Sleep
RtlUnwind
HeapSize
IsProcessorFeaturePresent
user32
IsCharAlphaA
advapi32
RegQueryValueExW
AllocateAndInitializeSid
RegQueryValueExA
CloseServiceHandle
GetAclInformation
CryptAcquireContextA
GetLengthSid
AdjustTokenPrivileges
CryptGenRandom
CopySid
CheckTokenMembership
RegCreateKeyW
ChangeServiceConfigW
RegOpenKeyW
FreeSid
RegEnumKeyExA
RegEnumValueW
RegFlushKey
RegisterEventSourceW
OpenProcessToken
RegSetValueExA
GetSecurityDescriptorLength
LsaClose
IsValidSid
RegEnumValueA
GetUserNameW
AddAce
GetSecurityDescriptorSacl
RegCreateKeyExA
CryptGetHashParam
RegQueryInfoKeyA
OpenSCManagerA
SetEntriesInAclW
EqualSid
LsaOpenPolicy
RegCreateKeyExW
ImpersonateLoggedOnUser
GetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegDeleteKeyW
OpenThreadToken
RegDeleteValueA
CryptHashData
CryptAcquireContextW
AddAccessAllowedAce
RegOpenKeyExW
LsaQueryInformationPolicy
RegSetValueExW
SetSecurityDescriptorOwner
RegOpenKeyExA
RegOpenKeyA
SetThreadToken
GetSidSubAuthorityCount
StartServiceA
RegQueryValueW
GetTokenInformation
CryptCreateHash
DeregisterEventSource
GetSecurityDescriptorControl
LsaFreeMemory
RegCreateKeyA
Sections
.text Size: 315KB - Virtual size: 315KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 567KB - Virtual size: 567KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 309KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ