Static task
static1
Behavioral task
behavioral1
Sample
b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118
-
Size
793KB
-
MD5
b2898066b6f6c833c1047ab5e30c3575
-
SHA1
ac45c3ccaa6857469a4e33765149b49904d1aac5
-
SHA256
d7604f4d245bf3521a1e70aa4191db496cf0095ece368f1a4b1fb6825b66e8c7
-
SHA512
ef3568d984e477d9f2292f76b10f34e72496c8cc48555aab13332dd2963785936f5a5a48344b4b1252f6afd1ee6029e277d6f0454c2dba54aba6e2b24834fb50
-
SSDEEP
12288:iAf2vJmTR7QxTRoMgurL5fAor9QPUtZcQcC4rAT6TXSBgM71N9cuy:ixv0kTRoMgu9XBPvXTIM7Xg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118
Files
-
b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe windows:5 windows x86 arch:x86
fa9de10139d84c0c413cf1a2892f37cb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExpandEnvironmentStringsW
FlushConsoleInputBuffer
GetProcessPriorityBoost
SetTapeParameters
CreateEventA
GetFullPathNameW
GetProcessWorkingSetSize
SetThreadLocale
CreateWaitableTimerA
FindAtomW
SetThreadContext
VerifyVersionInfoW
SetFileTime
SetConsoleActiveScreenBuffer
GetStringTypeExW
OpenJobObjectW
Module32First
GetConsoleScreenBufferInfo
GetFileAttributesExW
GetDateFormatA
FindResourceW
CreateSemaphoreW
DuplicateHandle
GetModuleFileNameA
ConvertDefaultLocale
CreateTapePartition
GetFileType
GetStringTypeExA
GetAtomNameA
CreateMutexA
OpenWaitableTimerA
SetConsoleOutputCP
GetCompressedFileSizeW
QueryInformationJobObject
OpenProcess
LoadResource
GetNamedPipeHandleStateA
GetFileAttributesExA
AssignProcessToJobObject
GetTempPathA
SetThreadPriority
IsValidCodePage
SetSystemPowerState
VerSetConditionMask
GetConsoleAliasExesLengthA
GetCPInfo
GetProfileSectionW
CreateFileW
SetInformationJobObject
DosDateTimeToFileTime
CompareStringA
GetFileAttributesA
SetCurrentDirectoryA
GetLogicalDrives
GetTimeFormatA
GetPrivateProfileSectionA
GetConsoleCP
DeleteVolumeMountPointA
FindFirstFileA
FindAtomA
CreateNamedPipeW
GetUserDefaultLangID
GetDateFormatW
SetConsoleCP
GetThreadPriority
GetFileSize
GetLongPathNameA
CopyFileA
GetNumberFormatW
MoveFileWithProgressW
DefineDosDeviceA
SetComputerNameExW
GetWindowsDirectoryA
CreateDirectoryExW
SetSystemTimeAdjustment
GetPrivateProfileIntW
GetFileTime
GetConsoleOutputCP
GetVolumeInformationA
CreateJobObjectA
SetLocaleInfoA
GetCalendarInfoA
CreateSemaphoreA
GetConsoleAliasW
GetStdHandle
GetUserDefaultUILanguage
GetDiskFreeSpaceW
GetThreadTimes
SetMailslotInfo
VirtualAlloc
LCMapStringA
GetStringTypeW
OpenEventA
GetDevicePowerState
GetCurrencyFormatW
PeekNamedPipe
DefineDosDeviceW
GetTempPathW
GetProfileIntA
SetConsoleTextAttribute
CopyFileW
SetEndOfFile
MapViewOfFile
EnumCalendarInfoW
GetAtomNameW
GetACP
GetPrivateProfileStructA
GetDiskFreeSpaceExW
FoldStringA
GetConsoleAliasExesW
Module32FirstW
GetProcessTimes
SetFileAttributesW
SetThreadExecutionState
GetPrivateProfileIntA
GetUserDefaultLCID
CreateJobObjectW
CreateToolhelp32Snapshot
GetModuleHandleA
CopyFileExA
GetProfileSectionA
GetThreadContext
SetConsoleDisplayMode
DisconnectNamedPipe
SetFileAttributesA
GetFileInformationByHandle
CancelWaitableTimer
OpenFileMappingA
FindVolumeClose
MoveFileWithProgressA
SetConsoleMode
GetVolumePathNameW
GetHandleInformation
CreateFileMappingA
GetProfileStringW
FoldStringW
GetCPInfoExW
ReleaseMutex
GetCurrentThread
SetEvent
OpenThread
GetThreadLocale
SetCurrentDirectoryW
GetFileAttributesW
GetProfileStringA
FormatMessageW
MultiByteToWideChar
GetConsoleAliasExesA
FindVolumeMountPointClose
ReplaceFileA
SetComputerNameExA
CreateWaitableTimerW
GetConsoleAliasesA
CreateIoCompletionPort
CreateMutexW
GetVolumePathNameA
SetCalendarInfoW
GetNamedPipeInfo
FormatMessageA
OpenSemaphoreA
SetTapePosition
GetPrivateProfileStructW
FindResourceExW
GetPrivateProfileStringA
GetLogicalDriveStringsW
LCMapStringW
SetConsoleCtrlHandler
GetTapeStatus
GetSystemDirectoryW
GetBinaryTypeA
GetSystemDirectoryA
FlushInstructionCache
SearchPathA
GetDriveTypeW
OpenFileMappingW
GetFullPathNameA
DeleteTimerQueue
ResetWriteWatch
BindIoCompletionCallback
GetBinaryTypeW
SwitchToThread
GetOEMCP
CreateDirectoryW
Module32Next
OpenEventW
CreateNamedPipeA
SetUnhandledExceptionFilter
SetEnvironmentVariableA
CreateDirectoryA
CreateMailslotW
ReleaseSemaphore
WideCharToMultiByte
ChangeTimerQueueTimer
DnsHostnameToComputerNameA
SetProcessPriorityBoost
ReadProcessMemory
GetShortPathNameA
GetConsoleMode
AddAtomA
FreeEnvironmentStringsA
GetSystemDefaultLCID
GetDiskFreeSpaceA
IsDBCSLeadByteEx
CreateTimerQueue
FreeConsole
GetCurrentConsoleFont
SetNamedPipeHandleState
FindFirstVolumeA
GetNamedPipeHandleStateW
Module32NextW
GetNumberFormatA
HeapReAlloc
HeapAlloc
GetSystemWindowsDirectoryW
GetPrivateProfileStringW
GetConsoleAliasA
SetHandleInformation
GetPriorityClass
GetStringTypeA
OpenMutexW
GetVolumeNameForVolumeMountPointA
GetCurrentProcess
DeleteTimerQueueEx
GetCalendarInfoW
GetSystemDefaultLangID
SetVolumeMountPointA
CreateDirectoryExA
GetDiskFreeSpaceExA
GetCompressedFileSizeA
GetEnvironmentStrings
GetConsoleAliasesW
GetCPInfoExA
GetVersion
GetMailslotInfo
EnumCalendarInfoExA
ReadDirectoryChangesW
SetStdHandle
OpenMutexA
CreateHardLinkW
EnumCalendarInfoExW
GetModuleHandleW
MapViewOfFileEx
SetErrorMode
SetThreadIdealProcessor
SetPriorityClass
AddAtomW
SetWaitableTimer
FreeUserPhysicalPages
GetPrivateProfileSectionNamesA
GetSystemDefaultUILanguage
IsSystemResumeAutomatic
FindFirstVolumeW
DeleteAtom
ContinueDebugEvent
GetModuleFileNameW
SetThreadPriorityBoost
ReadFile
FindNextChangeNotification
ProcessIdToSessionId
GetConsoleCursorInfo
ResetEvent
GetLocaleInfoW
DeviceIoControl
GetTimeFormatW
GetConsoleWindow
OpenJobObjectA
GetLocaleInfoA
FlushViewOfFile
GetProcessAffinityMask
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetProcAddress
ExitProcess
DecodePointer
WriteFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
HeapFree
Sleep
RtlUnwind
HeapSize
IsProcessorFeaturePresent
user32
IsCharAlphaA
advapi32
RegEnumKeyW
OpenProcessToken
InitializeSecurityDescriptor
CryptAcquireContextA
AdjustTokenPrivileges
CreateProcessAsUserW
RegDeleteKeyA
CloseServiceHandle
CopySid
ImpersonateLoggedOnUser
CryptAcquireContextW
GetSidSubAuthorityCount
CryptGenRandom
RegSetValueExW
LsaClose
OpenSCManagerA
RegFlushKey
EqualSid
MakeSelfRelativeSD
DeregisterEventSource
ReportEventW
SetNamedSecurityInfoW
RegCreateKeyA
GetSecurityDescriptorGroup
RegOpenKeyA
RegOpenKeyExA
RegDeleteKeyW
StartServiceW
GetSidSubAuthority
OpenSCManagerW
GetAce
SetSecurityDescriptorGroup
RegEnumValueW
RegCloseKey
GetLengthSid
RegQueryInfoKeyW
RegCreateKeyW
LookupAccountNameW
RegQueryInfoKeyA
LookupAccountSidW
ControlService
RegEnumValueA
GetSecurityDescriptorDacl
SetServiceStatus
AllocateAndInitializeSid
RegQueryValueExA
RegQueryValueExW
RegOpenKeyW
DuplicateTokenEx
SetSecurityDescriptorOwner
QueryServiceConfigW
CryptHashData
GetSecurityDescriptorOwner
CheckTokenMembership
AddAce
Sections
.text Size: 545KB - Virtual size: 544KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 228KB - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 346KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ