Static task
static1
Behavioral task
behavioral1
Sample
17af7aa47467380c6d70f534e74f49c2_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
17af7aa47467380c6d70f534e74f49c2_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
17af7aa47467380c6d70f534e74f49c2_JaffaCakes118
-
Size
139KB
-
MD5
17af7aa47467380c6d70f534e74f49c2
-
SHA1
02ce085242ea7fbb383cf7453c5361bd520c446c
-
SHA256
1fbfe224feecee39db0be06f14b890c04f05cae7c2a2a4198c260de2eee91e08
-
SHA512
1e4814b79af6f2ba5e88a5afe1b1d5b1e93550229aee85dafdac2c7ab482a13b0351e2f03bd4ffb89c3ab9f20d9d38b6a27f62c3cbde06705bc6555c08bab650
-
SSDEEP
3072:+tZLenDxSJQRe12jCX9WfCVOYfvm40VNZJzaPFYLUexK2J33bnCrY:+tZLe+QRe122g2m4Y7aPFVe3JmrY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17af7aa47467380c6d70f534e74f49c2_JaffaCakes118
Files
-
17af7aa47467380c6d70f534e74f49c2_JaffaCakes118.exe windows:5 windows x86 arch:x86
ffba68091d51aad1ef0b93e2808d14bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTimeZoneInformation
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
GetProcAddress
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
Module32FirstW
WaitForMultipleObjects
lstrcmpiW
FindNextFileW
VirtualProtect
GetFileTime
Module32NextW
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
HeapAlloc
WriteProcessMemory
GetModuleFileNameW
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
lstrcmpiA
GlobalLock
InitializeCriticalSection
LeaveCriticalSection
GlobalUnlock
EnterCriticalSection
GetCurrentProcess
GetProcessId
GetFileAttributesExW
GetLocalTime
GetPrivateProfileStringW
GetPrivateProfileIntW
ExitProcess
WTSGetActiveConsoleSessionId
MoveFileExW
GetUserDefaultUILanguage
GetCommandLineW
SetErrorMode
GetComputerNameW
OpenEventW
DuplicateHandle
GetCurrentProcessId
CreateProcessW
FreeLibrary
ReadFile
Thread32Next
GetFileAttributesW
HeapCreate
HeapDestroy
ReadProcessMemory
Sleep
SetEndOfFile
SetThreadContext
LoadLibraryW
WideCharToMultiByte
Thread32First
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetTickCount
GetModuleHandleW
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
FindFirstFileW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetThreadContext
GetEnvironmentVariableW
ResetEvent
TerminateProcess
TlsSetValue
TlsGetValue
LocalFree
GetVersionExW
GetNativeSystemInfo
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
VirtualFreeEx
OpenProcess
CreateRemoteThread
TlsFree
CloseHandle
TlsAlloc
GetCurrentThreadId
CreateEventW
CreateFileMappingW
SetThreadPriority
GetCurrentThread
SetEvent
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
GetSystemTime
CreateMutexW
user32
PeekMessageW
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
PostMessageW
GetWindowInfo
DrawEdge
BeginPaint
GetUpdateRect
IntersectRect
EqualRect
PrintWindow
IsRectEmpty
RegisterClassExA
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
GetAncestor
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
OpenDesktopW
DrawIcon
GetIconInfo
SetCursorPos
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
CharLowerW
MapVirtualKeyW
ExitWindowsEx
GetSystemMetrics
GetKeyboardState
GetClipboardData
ToUnicode
GetMessageA
GetWindowRect
SetCapture
GetParent
GetClassLongW
PeekMessageA
SetWindowPos
GetWindowLongW
GetCursorPos
GetCapture
GetDCEx
IsWindow
ReleaseCapture
MapWindowPoints
CharLowerA
GetShellWindow
RegisterClassA
CharLowerBuffA
GetTopWindow
LoadImageW
MenuItemFromPoint
GetDC
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
ReleaseDC
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
HiliteMenuItem
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
TranslateMessage
SetKeyboardState
GetWindowThreadProcessId
DefFrameProcW
DefWindowProcW
CallWindowProcW
EndMenu
CallWindowProcA
SendMessageW
GetUserObjectInformationW
RegisterClassW
GetMessagePos
advapi32
GetLengthSid
ConvertSidToStringSidW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
InitiateSystemShutdownExW
RegEnumKeyExW
EqualSid
IsWellKnownSid
shlwapi
wvnsprintfW
PathRenameExtensionW
StrCmpNIW
StrStrIW
StrStrIA
PathQuoteSpacesW
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
UrlUnescapeA
shell32
ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW
secur32
GetUserNameExW
ole32
StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx
gdi32
SetViewportOrgEx
GdiFlush
CreateDIBSection
SetRectRgn
SaveDC
RestoreDC
DeleteDC
GetDeviceCaps
DeleteObject
SelectObject
GetDIBits
CreateCompatibleBitmap
CreateCompatibleDC
ws2_32
WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
getsockname
getpeername
recvfrom
sendto
WSASend
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
closesocket
send
listen
accept
WSAGetLastError
crypt32
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CryptUnprotectData
wininet
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA
oleaut32
VariantInit
SysAllocString
VariantClear
SysFreeString
netapi32
NetApiBufferFree
NetUserEnum
NetUserGetInfo
Sections
.text Size: 131KB - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ