Static task
static1
Behavioral task
behavioral1
Sample
0cd92bd5ad057decffa6583b01b31546_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0cd92bd5ad057decffa6583b01b31546_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0cd92bd5ad057decffa6583b01b31546_JaffaCakes118
-
Size
868KB
-
MD5
0cd92bd5ad057decffa6583b01b31546
-
SHA1
8bcb985325606c9cd4fa85a32dcef0ddc3fb3926
-
SHA256
7726225acc24fe34b6587c2ecec1697aaec6d64fb68473c37739311bed9708f7
-
SHA512
d544d2719b66c2a932664c1965b6dca001dc686c1dd46f9f4df68b77556338fab084d9e122c8b04fcafaf1059ac370e9bc2016165b30058515f8d5736944b1d1
-
SSDEEP
24576:sfGT5TWyso9B/U97m0EPkLCTNh/+tTsCzp2z7TC:EI5T3pzAPAkLCGaCzpe7+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0cd92bd5ad057decffa6583b01b31546_JaffaCakes118
Files
-
0cd92bd5ad057decffa6583b01b31546_JaffaCakes118.exe windows:5 windows x86 arch:x86
c2ed846536fb0335966eb092d85345bd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
SetWindowTextW
OemToCharBuffA
DrawTextExA
PostMessageW
EnumPropsExA
SendDlgItemMessageA
GetUserObjectInformationA
GetClipboardSequenceNumber
GetClassInfoW
GetMenuItemInfoA
UserRealizePalette
CreateCursor
RealGetWindowClass
TabbedTextOutA
IsServerSideWindow
DdeInitializeW
GetScrollRange
IMPQueryIMEW
DestroyWindow
DefWindowProcW
SetWindowsHookExW
GetClientRect
GetUpdateRect
CopyAcceleratorTableA
SetCursorPos
CheckMenuRadioItem
MapVirtualKeyExW
TileWindows
GetKeyNameTextW
SetPropW
OpenWindowStationW
DdeQueryConvInfo
GetMenuState
CsrBroadcastSystemMessageExW
GetQueueStatus
SetWindowPos
SetMenuItemInfoA
GetKeyboardLayout
IsCharAlphaA
DdeFreeDataHandle
MsgWaitForMultipleObjectsEx
DefDlgProcW
SetWindowLongW
GetDialogBaseUnits
kernel32
ActivateActCtx
DelayLoadFailureHook
EscapeCommFunction
FoldStringA
GetCurrentConsoleFont
SetFileValidData
OutputDebugStringA
GetProcAddress
SetLocalPrimaryComputerNameW
ReadConsoleOutputA
SetVolumeLabelW
HeapCreate
WaitForDebugEvent
GetPrivateProfileSectionA
EnumDateFormatsA
OpenFile
FindActCtxSectionStringW
SetComputerNameExW
VirtualFree
TermsrvAppInstallMode
GlobalMemoryStatus
Beep
GetConsoleAliasesA
WriteConsoleOutputW
InitializeCriticalSectionAndSpinCount
GetNumaHighestNodeNumber
SetVolumeMountPointW
ExpungeConsoleCommandHistoryA
Module32NextW
LoadModule
FillConsoleOutputCharacterW
GetSystemDefaultLCID
GetACP
WriteProfileStringA
Process32NextW
IsBadStringPtrW
LoadLibraryA
CopyLZFile
MapViewOfFileEx
GetConsoleWindow
AddConsoleAliasW
FindNextVolumeA
VirtualAlloc
WaitNamedPipeA
GetProcessWorkingSetSize
WaitNamedPipeW
CreateDirectoryExW
EnumSystemLanguageGroupsW
CreateWaitableTimerW
ReadDirectoryChangesW
FreeResource
GetEnvironmentStringsW
MoveFileWithProgressA
IsDebuggerPresent
GetFileType
UpdateResourceA
GetCommandLineW
SetThreadExecutionState
CreateMutexW
FileTimeToLocalFileTime
CreateTimerQueue
SetFileApisToANSI
ReadFileEx
ExpungeConsoleCommandHistoryW
LCMapStringW
RtlZeroMemory
GetVersion
advapi32
GetTraceEnableLevel
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptGetKeyParam
ElfReportEventA
GetNumberOfEventLogRecords
ElfReadEventLogA
ElfReportEventW
LsaQueryInfoTrustedDomain
LsaLookupPrivilegeName
WmiQuerySingleInstanceA
QueryServiceConfigA
AdjustTokenPrivileges
OpenEventLogA
AddAuditAccessObjectAce
SaferiSearchMatchingHashRules
RegRestoreKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorA
ElfReadEventLogW
CryptGetHashParam
LsaICLookupSids
IsTokenRestricted
ReadEventLogW
AddAccessDeniedAce
RegLoadKeyW
CredpDecodeCredential
CryptDeriveKey
ObjectCloseAuditAlarmW
SetKernelObjectSecurity
FreeEncryptionCertificateHashList
UninstallApplication
CryptSetProvParam
CryptSignHashA
GetSecurityDescriptorDacl
msvcrt40
_adj_fdivr_m32i
_cabs
fread
_getsystime
putwc
??_Distream@@QAEXXZ
?name@type_info@@QBEPBDXZ
?sunk_with_stdio@ios@@0HA
??3@YAXPAX@Z
_iob
?precision@ios@@QBEHXZ
?seekoff@streambuf@@UAEJJW4seek_dir@ios@@H@Z
div
??4istream_withassign@@QAEAAV0@ABV0@@Z
??4bad_cast@@QAEAAV0@ABV0@@Z
_findnexti64
??5istream@@QAEAAV0@PAD@Z
__p___winitenv
?lock@ios@@QAAXXZ
_strncoll
_inpd
wcsncpy
??_Gstrstreambuf@@UAEPAXI@Z
??_Eistream_withassign@@UAEPAXI@Z
_sopen
??_Gostrstream@@UAEPAXI@Z
_mbschr
_setmaxstdio
??_8ostream_withassign@@7B@
iswprint
__p__tzname
_ungetch
_findnext
asctime
?str@ostrstream@@QAEPADXZ
_fcvt
__p__amblksiz
strcspn
??6ostream@@QAEAAV0@E@Z
??4ios@@IAEAAV0@ABV0@@Z
_CIfmod
??_Diostream@@QAEXXZ
_mbsrchr
?fill@ios@@QAEDD@Z
query
??0CRegAccess@@QAE@KPBG@Z
?_wcstoui64@@YA_KPBGPAPAGH@Z
?SetProperty@CDbColId@@QAEHPBG@Z
?GetLong@CMemDeSerStream@@UAEJXZ
?DetermineDriveType@CiStorage@@SGIPBG@Z
?GetChar@CMemDeSerStream@@UAEXPADK@Z
??0CIndexTable@@QAE@AAVCiStorage@@AAVCTransaction@@@Z
?Cleanup@CDbProp@@QAEXXZ
?ClearList@CPropertyList@@QAEXXZ
?SetStartKey@CRangeRestriction@@QAEXABVCKeyBuf@@@Z
CIBuildQueryTree
??1CDbPropBaseRestriction@@QAE@XZ
?CheckHasIndexTable@CiStorage@@SGHPBG@Z
?Disconnect@CRequestClient@@QAEXXZ
?SetLPWSTR@CStorageVariant@@QAEXPBGI@Z
?ContainsDrive@CDriveInfo@@SGHPBG@Z
?Set@CPidRemapper@@QAEXAAV?$XArray@K@@@Z
??0CSort@@QAE@I@Z
?Next@CPropertyList@@UAEPBVCPropEntry@@XZ
CITextToSelectTreeEx
??0CMemSerStream@@QAE@I@Z
?Initialize@CImpersonationTokenCache@@QAEXPBGHHHKKK@Z
??0CDbColId@@QAE@XZ
?SetUI8@CStorageVariant@@QAEXT_ULARGE_INTEGER@@I@Z
?LocaleToCodepage@@YGKK@Z
?SetProperty@CFullPropSpec@@QAEHPBG@Z
sqlunirl
_CallMsgFilter_@8
_ExpandEnvironmentStrings_@12
_EnumPropsEx_@12
_RegisterClassEx_@4
_PrintDlg_@4
_GetAtomName_@12
_wvsprintf_@12
_LoadCursorFromFile_@4
_RegUnLoadKey_@8
_GlobalGetAtomName_@12
_SetClassLong_@12
wsprintf_
_DefMDIChildProc_@16
_GetCharWidth32_@16
_CopyEnhMetaFile_@8
_TextOut@20
_AddFontResource_@4
_OutputDebugString_@4
_GetEnvironmentVariable_@12
_GetEnhMetaFile_@4
_ObjectPrivilegeAuditAlarm_@24
_ResetDC_@8
_CharLowerBuff_@8
_QueryDosDevice_@12
_CreateIC_@16
_CreateEvent_@16
_lstrcmp_@8
_GetModuleFileName@12
_GetCommandLine_@0
_BroadcastSystemMessage_@20
_CharToOemBuff_@12
_AppendMenu_@16
_GetProp@8
_MessageBoxIndirect_@4
_LogonUser_@24
_FindWindowEx_@16
_StartDoc@8
_GetLocaleInfo_@16
newWideCharFromMultiByte
newMultiByteFromWideCharEx
_CharToOem_@8
gdi32
DdEntry26
GetRgnBox
CopyEnhMetaFileW
GetObjectType
SetDIBColorTable
RemoveFontResourceExA
GetTextExtentExPointWPri
GetOutlineTextMetricsW
GetPolyFillMode
ArcTo
SelectObject
EngMarkBandingSurface
EngReleaseSemaphore
DdEntry43
GetTransform
ExtCreateRegion
GdiStartPageEMF
GdiPlayJournal
GdiProcessSetup
PolyBezier
EngFindResource
CreateICW
CreateHalftonePalette
CLIPOBJ_ppoGetPath
GetTextCharset
GetObjectW
GdiEntry11
EnumEnhMetaFile
ClearBitmapAttributes
GetEUDCTimeStamp
GdiEntry6
BRUSHOBJ_hGetColorTransform
SetVirtualResolution
bInitSystemAndFontsDirectoriesW
PolyPolygon
GetViewportExtEx
DdEntry23
EngUnlockSurface
crypt32
CryptImportPublicKeyInfoEx
CertGetCTLContextProperty
CertAddEncodedCertificateToStore
CertDuplicateCTLContext
CertRegisterPhysicalStore
RegCreateKeyExU
RegQueryValueExU
CryptSignHashU
CryptGetDefaultOIDFunctionAddress
CertAddCTLLinkToStore
CryptGetKeyIdentifierProperty
CertAddCRLLinkToStore
CryptSIPRetrieveSubjectGuidForCatalogFile
CertSetEnhancedKeyUsage
CryptGetMessageCertificates
PFXImportCertStore
CertCreateCTLContext
CertControlStore
CertCreateCRLContext
I_CryptFlushLruCache
CryptStringToBinaryW
CertCloseStore
CryptEncodeObject
CertCompareCertificate
CryptHashPublicKeyInfo
CertAddCTLContextToStore
CryptBinaryToStringA
CertVerifyCRLRevocation
CertCreateCertificateContext
CryptExportPublicKeyInfo
CertFreeCertificateContext
CertGetCertificateChain
CryptQueryObject
CryptMsgVerifyCountersignatureEncodedEx
CertAddCertificateLinkToStore
CryptHashToBeSigned
CertAddCRLContextToStore
CertComparePublicKeyInfo
CertSerializeCertificateStoreElement
CertCreateContext
dnsapi
Dns_WriteQuestionToMessage
DnsQueryConfigDword
Dns_UpdateLib
Dns_CreateMulticastSocket
DnsFlushResolverCacheEntry_A
DnsRecordBuild_UTF8
DnsReplaceRecordSetW
DnsReplaceRecordSetUTF8
DnsRecordTypeForName
DnsRecordListFree
Dns_PingAdapterServers
DnsNotifyResolverEx
DnsGlobals
DnsUpdateTest_W
Dns_SendAndRecvUdp
NetInfo_Copy
DnsGetBufferLengthForStringCopy
DnsUnicodeToUtf8
DnsCreateReverseNameStringForIpAddress
Dns_ParsePacketRecord
DnsNotifyResolver
DnsRegisterClusterAddress
DnsQueryExW
NetInfo_IsForUpdate
NetInfo_Clean
DnsAsyncRegisterHostAddrs
Dns_CloseSocket
DnsRemoveRegistrations
Sections
.text Size: 375KB - Virtual size: 375KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 217KB - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 272KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ