Static task
static1
Behavioral task
behavioral1
Sample
7ed56c483a169bc9a8d241374ce01ecd_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7ed56c483a169bc9a8d241374ce01ecd_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
7ed56c483a169bc9a8d241374ce01ecd_JaffaCakes118
-
Size
1.1MB
-
MD5
7ed56c483a169bc9a8d241374ce01ecd
-
SHA1
7485abed927bb7ae96620121df03fd2305f4b898
-
SHA256
2454fa7593fa9beff17d66cca35682d4f2b3d8ac3b9db02fef0d58d9e927f65a
-
SHA512
c3f0568961aefa3e54edb05bc7ca829103c38055a4bdcd31814e13bce1ea9ae1aba5bbcfe13b16598076da30e06b1945d2613322b78f6ceba205ee10ebb12c4b
-
SSDEEP
24576:fkPGWZ9UrsCxja7HQFCoGuk78GQSUiWnO+1f:YG5rP0kVGukAVIWO+1f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7ed56c483a169bc9a8d241374ce01ecd_JaffaCakes118
Files
-
7ed56c483a169bc9a8d241374ce01ecd_JaffaCakes118.exe windows:5 windows x86 arch:x86
004b1836272231082c8370ef39ab6d59
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadResource
SizeofResource
LockResource
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiA
GetTickCount
WaitForSingleObject
OpenMutexW
CreateEventW
OpenEventW
ReleaseMutex
GetVersionExW
TerminateThread
SuspendThread
CreateThread
GetUserDefaultLangID
MulDiv
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
TryEnterCriticalSection
GetModuleFileNameW
WaitForMultipleObjects
InterlockedIncrement
FindResourceW
InitializeCriticalSectionAndSpinCount
DecodePointer
GetSystemDefaultUILanguage
LocalAlloc
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
GetCurrentThreadId
ExitProcess
SetEvent
ResetEvent
IsBadReadPtr
OutputDebugStringW
GetUserDefaultLCID
LCMapStringW
GetStringTypeExW
LoadLibraryA
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
FreeResource
CreateToolhelp32Snapshot
lstrcmpiW
Process32NextW
Process32FirstW
ReadProcessMemory
OpenProcess
CreateProcessW
FreeLibrary
GetProcAddress
LoadLibraryW
lstrcatW
GetLocaleInfoW
lstrlenA
ExpandEnvironmentStringsW
lstrcpyW
DeleteFileW
FindNextFileW
FindClose
lstrcmpW
GetFileAttributesW
GetCurrentProcess
FindFirstFileW
GetFileSize
GetEnvironmentVariableW
LocalFree
GetModuleHandleW
CloseHandle
SetLastError
GetLastError
lstrlenW
CreateFileW
ReadFile
Sleep
InterlockedDecrement
GetCurrentProcessId
user32
CreateWindowExW
CreatePopupMenu
ShowWindow
GetCursorPos
SetWindowPos
ReleaseDC
GetClassNameW
AppendMenuW
GetAsyncKeyState
TranslateMessage
CallNextHookEx
LoadCursorW
KillTimer
PostMessageW
GetTopWindow
PostQuitMessage
SetWindowsHookExW
DestroyWindow
MoveWindow
GetWindow
GetWindowTextW
ScreenToClient
InsertMenuW
ClientToScreen
GetMenuItemID
GetWindowInfo
IsRectEmpty
GetWindowThreadProcessId
EnumChildWindows
EnumWindows
MessageBoxW
RegisterClassW
UpdateWindow
DefWindowProcW
GetWindowRect
TrackPopupMenu
SetTimer
FillRect
DrawTextW
GetSubMenu
GetMenuStringW
GetClientRect
LoadBitmapW
GetMenuItemCount
DestroyMenu
ModifyMenuW
GetWindowLongW
CallWindowProcW
UnregisterClassW
GetParent
GetDC
IsWindow
GetSystemMetrics
IsWindowVisible
GetMessageW
FindWindowW
SendMessageW
DispatchMessageW
LoadStringW
GetMenuState
SetWindowLongW
LoadIconW
SetLayeredWindowAttributes
gdi32
GetDIBits
StretchBlt
CreateFontIndirectW
SetPixel
LineTo
MoveToEx
CreateDIBSection
SetBkMode
Rectangle
GetTextExtentPointW
SetDIBits
CreatePen
TextOutW
GetStockObject
GetBitmapBits
SetBitmapBits
BitBlt
DeleteDC
SetBkColor
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
ExtTextOutW
GetObjectW
SetTextColor
GetDeviceCaps
advapi32
RegCloseKey
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
RegSetValueExW
shell32
SHCreateDirectoryExW
ole32
CoInitialize
CLSIDFromProgID
CoCreateInstance
CreateStreamOnHGlobal
oleaut32
SysAllocString
VariantClear
VariantInit
SysFreeString
msvcp120
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?ws@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?ws@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_BADOFF@std@@3_JB
?id@?$codecvt@_WDH@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
??_7facet@locale@std@@6B@
??_7?$codecvt@_WDH@std@@6B@
??_7codecvt_base@std@@6B@
??_7_Facet_base@std@@6B@
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$codecvt@_WDH@std@@QAE@I@Z
?unshift@?$codecvt@_WDH@std@@QBEHAAHPAD1AAPAD@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
msvcr120
_itow_s
??8type_info@@QBE_NABV0@@Z
memset
memcpy
__CxxFrameHandler3
_CxxThrowException
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
??1type_info@@UAE@XZ
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
getchar
?terminate@@YAXXZ
_setmode
_fileno
__iob_func
isdigit
isalpha
round
nearbyint
_wtof
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
roundf
fputc
strncmp
isxdigit
toupper
memmove
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
??_V@YAXPAX@Z
_wtoi
atoi
_atoi64
memchr
_wtoi64
wcschr
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABV01@@Z
fputwc
_unlock_file
ungetwc
ungetc
fgetpos
_fseeki64
fflush
fgetc
fsetpos
setvbuf
_lock_file
fgetwc
memcpy_s
fwrite
fclose
_mktime64
_localtime64_s
wcsftime
_wsetlocale
strchr
_vsnwprintf_s
rand
_except1
_i64tow_s
_time64
free
_strdup
shlwapi
PathCombineW
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
msimg32
TransparentBlt
AlphaBlend
windowscodecs
WICConvertBitmapSource
Sections
.text Size: 701KB - Virtual size: 701KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 221KB - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ