Static task
static1
Behavioral task
behavioral1
Sample
08dda5430a3a742124591a9491aaffd1_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
08dda5430a3a742124591a9491aaffd1_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
08dda5430a3a742124591a9491aaffd1_JaffaCakes118
-
Size
868KB
-
MD5
08dda5430a3a742124591a9491aaffd1
-
SHA1
72ff25718e800e611f960fb72106c76bed369fc9
-
SHA256
159e0c232debba2642cae84249965623bb7e2501ea6aa48557e0a810fdc00a5b
-
SHA512
5098cc2fb66137f4d6e47c4f454156a8f579da3ff7ff45bc3808cfcdaffffd998e8ba576bdf5dd62068d633c0563927ec46873ba93d91898ba1e4ae415c2c886
-
SSDEEP
24576:1sbH5SrMO9bDVyYJ/dLuZHPc0DlkxKCUGyyYo6G:WSMOVYtjlMKjTno
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08dda5430a3a742124591a9491aaffd1_JaffaCakes118
Files
-
08dda5430a3a742124591a9491aaffd1_JaffaCakes118.exe windows:5 windows x86 arch:x86
9545a26da27fec8bc74698700e7fbdc7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
ZwReplaceKey
RtlUnicodeStringToInteger
RtlFindClearBitsAndSet
RtlCutoverTimeToSystemTime
RtlCopyString
RtlQueryInformationAcl
RtlQueryProcessBackTraceInformation
RtlEqualPrefixSid
ZwDeviceIoControlFile
ZwCancelIoFile
wcscspn
mbstowcs
ZwCreatePagingFile
RtlDeactivateActivationContextUnsafeFast
_ltow
ZwAdjustGroupsToken
RtlUnicodeStringToOemSize
RtlDecompressBuffer
RtlCreateUnicodeStringFromAsciiz
ZwOpenKey
CsrCaptureTimeout
RtlPrefixUnicodeString
NtAllocateVirtualMemory
RtlAddCompoundAce
RtlCaptureContext
ZwWriteFile
NtQueryVolumeInformationFile
RtlQueryInformationActivationContext
RtlAreAllAccessesGranted
RtlDowncaseUnicodeString
CsrIdentifyAlertableThread
RtlComputeCrc32
LdrGetProcedureAddress
RtlCreateTimer
RtlEnumProcessHeaps
ZwWriteFileGather
DbgUiDebugActiveProcess
RtlAreBitsClear
CsrAllocateMessagePointer
winmm
waveInGetErrorTextA
waveOutGetID
mmioStringToFOURCCW
waveOutReset
mmioAscend
WOW32DriverCallback
mixerGetLineInfoA
mciDriverNotify
mciSendCommandW
mixerGetDevCapsW
waveOutBreakLoop
midiConnect
joyReleaseCapture
waveOutGetDevCapsW
mixerGetControlDetailsA
mixerGetControlDetailsW
midiOutReset
waveOutGetErrorTextA
mciExecute
mixerSetControlDetails
mciGetDeviceIDFromElementIDA
mixerGetLineControlsA
auxGetDevCapsW
timeKillEvent
joyGetDevCapsA
joyGetThreshold
mciGetDeviceIDA
GetDriverModuleHandle
waveOutRestart
mmioSetBuffer
crtdll
_osver_dll
_pctype_dll
_copysign
_ismbslead
_mbccpy
_spawnvpe
_ismbbpunct
_CIpow
wcslen
_mktemp
_stricoll
_setsystime
strspn
div
_ismbcsymbol
_osmode_dll
_fcloseall
iswcntrl
ldiv
_getdllprocaddr
iswascii
vprintf
_ltow
_mbsset
srand
_ismbblead
??3@YAXPAX@Z
_fpieee_flt
untfs
??0NTFS_CLUSTER_RUN@@QAE@XZ
??1NTFS_INDEX_TREE@@UAE@XZ
??0NTFS_FILE_RECORD_SEGMENT@@QAE@XZ
??0NTFS_LOG_FILE@@QAE@XZ
?Resize@NTFS_ATTRIBUTE@@UAEEVBIG_INT@@PAVNTFS_BITMAP@@@Z
??1NTFS_MFT_FILE@@UAE@XZ
ChkdskEx
?Initialize@NTFS_SA@@QAEEPAVLOG_IO_DP_DRIVE@@PAVMESSAGE@@VBIG_INT@@2@Z
??0NTFS_ATTRIBUTE_RECORD@@QAE@XZ
?Initialize@NTFS_REFLECTED_MASTER_FILE_TABLE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?Initialize@NTFS_FILE_RECORD_SEGMENT@@QAEEXZ
?ReadAgain@NTFS_FRS_STRUCTURE@@QAEEVBIG_INT@@@Z
?CreateDataAttribute@NTFS_LOG_FILE@@QAEEVBIG_INT@@KPAVNTFS_BITMAP@@@Z
??0NTFS_ATTRIBUTE@@QAE@XZ
??0NTFS_FRS_STRUCTURE@@QAE@XZ
?QueryAttributeByOrdinal@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_ATTRIBUTE@@PAEKK@Z
?Initialize@NTFS_BOOT_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?InsertIntoFile@NTFS_ATTRIBUTE@@UAEEPAVNTFS_FILE_RECORD_SEGMENT@@PAVNTFS_BITMAP@@@Z
?SetVolumeFlag@NTFS_SA@@QAEEGPAE@Z
FormatEx
?Initialize@NTFS_EXTENT_LIST@@QAEEVBIG_INT@@0@Z
?QueryExtentList@NTFS_ATTRIBUTE_RECORD@@QBEEPAVNTFS_EXTENT_LIST@@@Z
?Write@NTFS_ATTRIBUTE@@UAEEPBXVBIG_INT@@KPAKPAVNTFS_BITMAP@@@Z
??1NTFS_BAD_CLUSTER_FILE@@UAE@XZ
?Initialize@NTFS_FILE_RECORD_SEGMENT@@QAEEVBIG_INT@@PAVNTFS_MASTER_FILE_TABLE@@@Z
kernel32
SetConsoleActiveScreenBuffer
ChangeTimerQueueTimer
DebugActiveProcess
LocalHandle
BuildCommDCBW
GetProfileSectionW
Module32First
IsValidLocale
NlsGetCacheUpdateCount
CompareStringW
TransmitCommChar
FindActCtxSectionStringA
GetLastError
QueryMemoryResourceNotification
GetWindowsDirectoryW
GetConsoleTitleA
FindFirstVolumeMountPointW
CreateSocketHandle
SetLastError
SetComputerNameExW
GetThreadTimes
UnmapViewOfFile
GetHandleContext
WriteProcessMemory
QueueUserAPC
AddAtomW
CallNamedPipeW
lstrcmp
InitializeCriticalSection
SetFileShortNameW
MapViewOfFile
GetProcessIoCounters
LoadLibraryA
LockFileEx
FormatMessageA
DuplicateConsoleHandle
GetComputerNameW
GetPrivateProfileIntA
GlobalFindAtomA
SetSystemPowerState
EnumSystemCodePagesW
VirtualAlloc
SetProcessAffinityMask
query
?GetStringDbRestriction@@YGPAVCDbRestriction@@PBGKPAUIColumnMapper@@K@Z
??0CColumns@@QAE@I@Z
?ReadProperty@COLEPropManager@@QAEHABVCFullPropSpec@@AAUtagPROPVARIANT@@@Z
?GetOleDBErrorInfo@@YGJPAUIUnknown@@ABU_GUID@@KIPAUtagERRORINFO@@PAPAUIErrorInfo@@@Z
?IsWaitingForDocument@CFilterDaemon@@QAEHXZ
?Close@CPipeClient@@IAEXXZ
?SetProperty@CFullPropSpec@@QAEHPBG@Z
?Resume@CProcess@@QAEXXZ
?GetR4@CAllocStorageVariant@@QBEMI@Z
?AddCachedProperty@CCatalogAdmin@@QAEXABVCFullPropSpec@@KKKH@Z
?_wcstoui64@@YA_KPBGPAPAGH@Z
?GetOleError@@YGJAAVCException@@@Z
??1CImpersonationTokenCache@@QAE@XZ
?FormFullTree@CTextToTree@@QAEPAUtagDBCOMMANDTREE@@XZ
??0CWorkQueue@@QAE@IW4WorkQueueType@0@@Z
?ClearList@CPropertyList@@QAEXXZ
?CiNtOpen@@YGPAXPBGKKK@Z
?SetCY@CStorageVariant@@QAEXTtagCY@@I@Z
??1CNatLanguageRestriction@@QAE@XZ
??0CPerfMon@@QAE@PBG@Z
?MakeLocalICommand@@YGJPAPAUIUnknown@@PAUICiCDocStore@@PAU1@@Z
??1CWorkManager@@QAE@XZ
?AppendListElement@CDbListAnchor@@IAEHGABUtagDBID@@@Z
??0CPropertyRestriction@@QAE@XZ
??1CDbPropBaseRestriction@@QAE@XZ
?AcqLine@CQueryScanner@@QAEPAGH@Z
?ReadProperty@CPropStoreManager@@QAEHKKPAUtagPROPVARIANT@@PAI@Z
_StartFWCiSvcWork@12
msvcrt40
??0ostream_withassign@@QAE@ABV0@@Z
_errno
iswlower
_ctype
_ftime
_heapset
acos
??_Eistream_withassign@@UAEPAXI@Z
setbuf
wcsncmp
_adj_fdiv_r
?put@ostream@@QAEAAV1@D@Z
fwrite
??5istream@@QAEAAV0@AAF@Z
??4stdiobuf@@QAEAAV0@ABV0@@Z
system
??_8istrstream@@7B@
bsearch
?pcount@strstream@@QBEHXZ
??1ofstream@@UAE@XZ
_wcsnicoll
_ungetch
?writepad@ostream@@AAEAAV1@PBD0@Z
_wexeclp
_utime
??_Estrstreambuf@@UAEPAXI@Z
srand
_getsystime
?ws@@YAAAVistream@@AAV1@@Z
strxfrm
atan
??_Estrstream@@UAEPAXI@Z
??0ostrstream@@QAE@XZ
??0fstream@@QAE@PBDHH@Z
??4istream_withassign@@QAEAAV0@ABV0@@Z
strncmp
putc
?str@strstream@@QAEPADXZ
_rotr
_mbsstr
?setbuf@filebuf@@UAEPAVstreambuf@@PADH@Z
??0__non_rtti_object@@QAE@PBD@Z
Sections
.text Size: 335KB - Virtual size: 335KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 338KB - Virtual size: 338KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 189KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ