Behavioral task
behavioral1
Sample
175551a90483d2a011e0b15f35403e2e_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
175551a90483d2a011e0b15f35403e2e_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
175551a90483d2a011e0b15f35403e2e_JaffaCakes118
-
Size
15.7MB
-
MD5
175551a90483d2a011e0b15f35403e2e
-
SHA1
03f7f1e201317699160b91de63d0d0a63f3b966d
-
SHA256
e8593c908f6ac1656d5261073be7df756b5dd5dd428742c090e2c0ad983df56d
-
SHA512
944c7f16ea535ff784a8f13d9670d23857ef3df9da779816a9765facd5ffd513c2be12d44b70215f686643b00b2da9dc88fd7f78731aaeeb0377e6ef1c840305
-
SSDEEP
393216:PXyAUghWTvZ+jpAmX+dVFC0eyEduBAziV:7U4WQCrC0Na1z2
Malware Config
Signatures
-
Detected TEARDROP fileless dropper 1 IoCs
TEARDROP is a memory-only dropper which can read files/registry keys, decode an embedded payload, and load it directly into memory.
resource yara_rule sample family_teardrop -
Teardrop family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 175551a90483d2a011e0b15f35403e2e_JaffaCakes118
Files
-
175551a90483d2a011e0b15f35403e2e_JaffaCakes118.exe windows:5 windows x86 arch:x86
890202b683d489fbb932c1708f36ace6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
avifil32
AVIStreamSetFormat
AVIStreamWrite
AVIStreamRelease
AVIFileRelease
AVIFileExit
AVIFileInit
AVIFileOpenA
AVIFileCreateStreamA
AVISaveOptions
AVISaveOptionsFree
AVIMakeCompressedStream
winmm
timeBeginPeriod
waveOutRestart
waveOutPause
waveOutGetPosition
waveOutPrepareHeader
timeGetTime
timeEndPeriod
waveOutGetID
waveOutOpen
waveOutWrite
waveOutClose
waveOutUnprepareHeader
waveOutReset
kernel32
GetCPInfo
GetOEMCP
GetAtomNameA
GetModuleHandleW
SetErrorMode
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileAttributesA
GetFileSizeEx
GetFileTime
GetCurrentDirectoryA
RtlUnwind
HeapReAlloc
GetTimeFormatA
GetDateFormatA
ExitProcess
FindNextFileA
RaiseException
GetTimeZoneInformation
GetDriveTypeA
GetSystemTimeAsFileTime
HeapSize
GetCommandLineA
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetConsoleCP
GetConsoleMode
GetFileType
ExitThread
CreateThread
VirtualProtect
GetSystemInfo
VirtualQuery
TerminateProcess
IsDebuggerPresent
HeapCreate
HeapDestroy
FatalAppExitA
GetStdHandle
GetACP
InterlockedIncrement
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
SetHandleCount
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
SetCurrentDirectoryA
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
SetStdHandle
GetFileInformationByHandle
PeekNamedPipe
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
CompareStringW
SetEnvironmentVariableA
IsDBCSLeadByteEx
FindResourceA
SizeofResource
LockResource
LoadResource
WideCharToMultiByte
QueryPerformanceFrequency
QueryPerformanceCounter
Sleep
LeaveCriticalSection
TryEnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MulDiv
SetEvent
WaitForMultipleObjects
CloseHandle
WaitForSingleObject
GetExitCodeThread
CreateEventA
EnterCriticalSection
WritePrivateProfileStringA
GetPrivateProfileIntA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GlobalFlags
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
lstrcmpA
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileStructA
WritePrivateProfileStructA
GetPrivateProfileSectionA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
lstrcmpiA
GetThreadLocale
GetStringTypeExA
DeleteFileA
MoveFileA
SystemTimeToFileTime
FileTimeToSystemTime
SuspendThread
ResumeThread
SetThreadPriority
GlobalFree
GlobalSize
GlobalAlloc
LocalFree
ReadFile
lstrlenW
GetCurrentProcessId
GetModuleFileNameA
InterlockedDecrement
GetModuleFileNameW
lstrlenA
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
CompareStringA
LoadLibraryA
MultiByteToWideChar
lstrcmpW
GetVersionExA
GlobalLock
GlobalUnlock
SetLastError
VirtualAlloc
VirtualFree
ReleaseSemaphore
CreateSemaphoreA
GetProcAddress
GetModuleHandleA
FormatMessageA
HeapFree
GetProcessHeap
HeapAlloc
CopyFileA
GetLastError
CreateFileA
GetFileSize
IsValidCodePage
user32
GetDialogBaseUnits
DeleteMenu
WaitMessage
SetRectEmpty
TranslateAcceleratorA
BringWindowToTop
InsertMenuItemA
LoadAcceleratorsA
GetMenuBarInfo
ReuseDDElParam
UnpackDDElParam
KillTimer
IsRectEmpty
GetSystemMenu
SetParent
UnionRect
GetDCEx
LockWindowUpdate
GetMenuStringA
InsertMenuA
RemoveMenu
GetWindowThreadProcessId
ScrollWindowEx
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
UnregisterClassA
ShowScrollBar
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetFocus
GetMenuState
EnableMenuItem
CheckMenuItem
GetKeyState
GetWindowDC
GrayStringA
DrawTextExA
TabbedTextOutA
MessageBoxA
LoadIconA
IsIconic
AppendMenuA
CreatePopupMenu
DrawIcon
BeginPaint
EndPaint
GetAsyncKeyState
SetCursorPos
PostQuitMessage
ScreenToClient
PtInRect
SetWindowPos
GetCursorPos
GetSystemMetrics
SetTimer
UpdateWindow
LoadBitmapA
LoadCursorA
SetCapture
RedrawWindow
ReleaseCapture
IsWindowVisible
IsWindowEnabled
SetRect
PostMessageA
IsWindow
PeekMessageA
MessageBeep
GetDC
DrawTextA
ReleaseDC
GetWindowLongA
EnableWindow
GetSysColorBrush
GetMenuItemInfoA
ShowOwnedPopups
MapVirtualKeyA
GetKeyNameTextA
CharUpperA
WindowFromPoint
GetParent
GetNextDlgTabItem
GetMessageA
TranslateMessage
ValidateRect
GetDesktopWindow
CreateDialogIndirectParamA
SetForegroundWindow
EndDialog
GetActiveWindow
InvalidateRect
ClientToScreen
GetClientRect
GetWindowRect
SendMessageA
DrawFocusRect
DrawStateA
FrameRect
FillRect
OffsetRect
InflateRect
CopyRect
LoadMenuA
GetIconInfo
LoadImageA
GetSysColor
GetSubMenu
TrackPopupMenuEx
SetCursor
DestroyIcon
DestroyCursor
DestroyMenu
ModifyMenuA
gdi32
CreatePen
ExtFloodFill
CreateDIBSection
SetBitmapBits
StretchBlt
CreateSolidBrush
StretchDIBits
SetStretchBltMode
StartDocA
StartPage
EndPage
AbortDoc
EndDoc
SaveDC
RestoreDC
SetPolyFillMode
SetROP2
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
SetArcDirection
SetColorAdjustment
SelectClipRgn
GetClipRgn
GetDeviceCaps
SelectClipPath
GetViewportExtEx
GetWindowExtEx
GetPixel
SetDIBitsToDevice
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
CreateDIBPatternBrushPt
CreatePatternBrush
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
ExtCreatePen
CreateHatchBrush
GetDCOrgEx
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
CopyMetaFileA
CreateDCA
GetTextMetricsA
GetCharWidthA
CreateFontA
GetBkColor
PtVisible
SetDIBits
CreateFontIndirectA
GetTextExtentPoint32A
CreateDIBitmap
SetBkMode
GetDIBits
CreateCompatibleBitmap
GetObjectA
CreateBitmap
CreateCompatibleDC
SelectObject
SetBkColor
BitBlt
SetTextColor
DeleteDC
GetStockObject
CreateRectRgn
DeleteObject
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
ClosePrinter
DocumentPropertiesA
advapi32
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegDeleteValueA
RegSetValueA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCreateKeyA
RegOpenKeyExA
RegCloseKey
shell32
SHGetFileInfoA
ExtractIconA
DragFinish
DragQueryFileA
ShellExecuteExA
comctl32
_TrackMouseEvent
ord17
shlwapi
PathFindExtensionA
PathRemoveExtensionA
PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
PathFindFileNameA
ole32
SetConvertStg
WriteFmtUserTypeStg
CoTaskMemFree
OleRegGetUserType
ReadFmtUserTypeStg
ReadClassStg
StringFromCLSID
CoTreatAsClass
WriteClassStg
CreateBindCtx
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
CoUninitialize
CoCreateInstance
CoInitializeEx
CoDisconnectObject
StringFromGUID2
CLSIDFromString
oleaut32
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
VarDateFromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysStringLen
VariantClear
VariantChangeType
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SysReAllocStringLen
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarCyFromStr
VarBstrFromDate
VariantInit
SysAllocStringLen
ws2_32
WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
bind
closesocket
connect
gethostbyaddr
gethostbyname
gethostname
getservbyport
getsockname
getsockopt
htonl
htons
inet_ntoa
ioctlsocket
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket
msvcrt
_CIatan2
_CIfmod
__lc_codepage
__mb_cur_max
_iob
_pctype
_tempnam
_unlink
Sections
.text Size: 7.5MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text.un Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 271KB - Virtual size: 4.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 1024B - Virtual size: 793B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.debug_a Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.debug_i Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.debug_l Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.debug_f Size: 1024B - Virtual size: 649B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.debug_l Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.debug_p Size: 512B - Virtual size: 491B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.debug_a Size: 1024B - Virtual size: 524B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.debug_r Size: 1024B - Virtual size: 755B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 285KB - Virtual size: 285KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ