Static task
static1
Behavioral task
behavioral1
Sample
1aa63dfe34cb47f8b68821c3e06230de_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1aa63dfe34cb47f8b68821c3e06230de_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1aa63dfe34cb47f8b68821c3e06230de_JaffaCakes118
-
Size
274KB
-
MD5
1aa63dfe34cb47f8b68821c3e06230de
-
SHA1
ac850a6d00c01e0e5bc4aeed00b96e7c79019a17
-
SHA256
112322e78d6816814b72ee7dcf1ac5d2d27bcbeace75caf557f8adfecefba0ed
-
SHA512
9b6d14ae487a4ebcef8c82888e145d880768a00d74d89032de640b4b5fa781e45cc43f3b952bdd046c167258a7687fb64c905a58fb430995969d09e353fe4a85
-
SSDEEP
6144:53hRbH7M7kBdMocwyEVAIepVXrWprSyP18SCrjBAer:Rh2kd6wyOfepVXarSyP1Gjp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1aa63dfe34cb47f8b68821c3e06230de_JaffaCakes118
Files
-
1aa63dfe34cb47f8b68821c3e06230de_JaffaCakes118.exe windows:4 windows x86 arch:x86
17062a87b39ebf9fb21887f5e46ef5f6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
CreateFileA
GetWindowsDirectoryA
lstrlenA
lstrcpyA
VirtualAlloc
gdi32
EngCreateBitmap
ExtFloodFill
FrameRgn
EngGetDriverName
SetVirtualResolution
BRUSHOBJ_pvGetRbrush
EngStrokePath
SetDIBitsToDevice
GdiAlphaBlend
LineTo
FillPath
GetGlyphOutlineA
CreatePatternBrush
GetDIBColorTable
GdiIsMetaPrintDC
CopyMetaFileW
GdiDeleteLocalDC
EngAssociateSurface
GdiDllInitialize
ColorCorrectPalette
FONTOBJ_pQueryGlyphAttrs
SetViewportExtEx
GetKerningPairsA
EnumFontFamiliesExW
GetViewportOrgEx
EnumFontFamiliesW
SetWindowExtEx
FONTOBJ_vGetInfo
EngCreateClip
GetCharWidthFloatW
GdiCreateLocalEnhMetaFile
HT_Get8BPPMaskPalette
FONTOBJ_cGetAllGlyphHandles
GdiEntry10
GdiValidateHandle
SetROP2
GdiReleaseDC
GetBitmapDimensionEx
GdiAddGlsRecord
GetWorldTransform
UnloadNetworkFonts
BRUSHOBJ_hGetColorTransform
EngReleaseSemaphore
EngMarkBandingSurface
GetCharABCWidthsW
SetTextAlign
GdiEntry5
Pie
CreateBitmapIndirect
EnumFontsW
ResetDCW
GetRandomRgn
GdiDeleteSpoolFileHandle
CreatePalette
AngleArc
GdiEndPageEMF
GetTextExtentExPointI
GetRasterizerCaps
GetTextMetricsW
ExtTextOutW
SelectClipPath
TextOutW
GetLayout
GetMetaRgn
GetMetaFileW
ResetDCA
PlayEnhMetaFile
GdiInitializeLanguagePack
XFORMOBJ_bApplyXform
SetBkColor
GetObjectA
Rectangle
EndPath
GetCurrentObject
GdiPlayDCScript
SetBitmapDimensionEx
SelectClipRgn
SetBrushOrgEx
GdiDescribePixelFormat
CreateICA
MirrorRgn
SetRelAbs
TextOutA
GdiArtificialDecrementDriver
EngTextOut
GetEnhMetaFileHeader
GetDeviceCaps
GetGraphicsMode
CombineTransform
GetStockObject
CreateCompatibleDC
CreateFontIndirectW
PolyPolyline
CreateColorSpaceW
GetWindowOrgEx
GdiFlush
GdiEntry3
PolyPolygon
GdiSetAttrs
SetWinMetaFileBits
EndPage
SetTextJustification
FloodFill
GdiStartDocEMF
GdiGetDC
GetTextExtentExPointWPri
EngTransparentBlt
DPtoLP
PlayEnhMetaFileRecord
PATHOBJ_vEnumStart
GetEUDCTimeStampExW
GetICMProfileA
FONTOBJ_pfdg
GetColorSpace
RectInRegion
GetRgnBox
CreateRectRgn
CreateFontIndirectExW
CreateBrushIndirect
GetPath
CreateHalftonePalette
GetTextFaceA
FONTOBJ_pifi
SetGraphicsMode
GdiGetPageCount
GetCharWidthI
STROBJ_vEnumStart
EnumICMProfilesA
GetBkColor
BitBlt
GetNearestPaletteIndex
EngStretchBltROP
GetOutlineTextMetricsA
SelectFontLocal
EnumFontFamiliesA
Polyline
PolyBezier
Ellipse
Escape
SetMiterLimit
GdiSetBatchLimit
CopyMetaFileA
SetWindowOrgEx
EngFillPath
GetNearestColor
EudcLoadLinkW
EngCreateSemaphore
OffsetClipRgn
GetClipBox
GetDCPenColor
SetBoundsRect
PATHOBJ_bEnum
DeleteDC
GetTextCharset
GetEnhMetaFileDescriptionA
SetPixel
bInitSystemAndFontsDirectoriesW
ChoosePixelFormat
SetICMMode
MaskBlt
GdiGetSpoolFileHandle
CLIPOBJ_ppoGetPath
GdiInitSpool
CreateCompatibleBitmap
GetSystemPaletteEntries
RemoveFontResourceExW
PtVisible
GetEnhMetaFilePixelFormat
GetICMProfileW
GetTextExtentExPointA
msvcrt
ungetwc
sin
_mbscpy
_ftol
_toupper
_exit
_lsearch
_wexecvpe
_heapset
_isnan
_spawnle
_eof
_isctype
__RTCastToVoid
__iscsym
wprintf
_fileno
_utime64
iswpunct
_wmktemp
_mbbtype
_ui64toa
_fstat64
wcspbrk
_unloaddll
__pxcptinfoptrs
ldexp
_finite
_ui64tow
_adj_fdivr_m16i
_swab
_adj_fdiv_r
__set_app_type
setvbuf
_CIcosh
strcoll
__STRINGTOLD
_Getdays
fopen
_purecall
_setsystime
realloc
free
_wfopen
_mbsset
mbtowc
_spawnlpe
_putws
__wgetmainargs
clock
wcsrchr
_wpgmptr
_wfreopen
_execvpe
_heapwalk
_msize
__getmainargs
_mkdir
__p__mbcasemap
_callnewh
__dllonexit
wcslen
_dup
fgets
_putch
isprint
atexit
_getw
_get_sbh_threshold
__winitenv
_safe_fdiv
_beep
_setmbcp
_strnicmp
_clearfp
_cgets
wcstol
wcstombs
strstr
_cprintf
_CIfmod
floor
_CIsin
_wexecve
_putw
cos
is_wctype
strtol
wcsspn
_creat
_ecvt
_wunlink
_wexecle
wcsftime
_wsearchenv
gmtime
strcmp
strcat
_popen
_Gettnames
wcstod
_wrename
_wfindfirst64
wcscpy
_strlwr
_chdrive
_strtime
__lc_collate_cp
time
_mbscoll
atol
_wcsrev
_pwctype
_jn
_strnset
_ismbchira
_wasctime
_pgmptr
sscanf
_getdcwd
_findnext
fputc
_ismbckata
_ismbcpunct
__fpecode
clearerr
setlocale
_mbclen
_set_sbh_threshold
_ismbcl1
_getws
_wgetcwd
atan2
strchr
_mbsupr
_sleep
_ismbbpunct
_rmdir
__p__amblksiz
_wmkdir
_mbschr
__crtCompareStringA
exit
strcspn
_wspawnvp
_stat
strlen
signal
fgetpos
_unlock
_setjmp
_setmode
_adj_fdiv_m64
putwc
_wspawnvpe
_flsbuf
rand
_CIsqrt
iswdigit
fgetc
_getmbcp
calloc
difftime
_wstat64
fflush
_lock
_chmod
_wfindfirsti64
_ismbbtrail
_environ
fgetwc
setbuf
tmpnam
_timezone
advapi32
RegOpenKeyExW
oleaut32
VarR8FromUI1
VarParseNumFromStr
SafeArraySetIID
VarUI1FromCy
VarUI1FromBool
VarDecFromR4
BSTR_UserUnmarshal
VarR4FromDate
SafeArrayGetElement
VarR4FromUI4
VarUI4FromDisp
VarBoolFromCy
VarDecFromCy
VarCyMul
VarUI2FromUI4
LPSAFEARRAY_Marshal
VarCyFromDisp
VarUI4FromDec
VarDecMul
VarWeekdayName
VarI4FromDate
VarUI1FromR4
VarBstrFromI4
LoadTypeLibEx
VarI4FromR4
VarR4FromCy
VarDecNeg
VarUI2FromI4
VariantTimeToDosDateTime
VarI4FromR8
SafeArrayLock
VarI2FromDec
SafeArrayDestroyDescriptor
VarAnd
VarI2FromR4
VarDecCmpR8
VarFormatNumber
VarCyRound
VarI1FromI4
VarBstrFromUI1
VarDecInt
VarBstrFromR8
VarI4FromBool
VarI1FromR8
OleLoadPictureFile
VarMul
VarOr
VarPow
VarI4FromStr
RevokeActiveObject
VarI4FromUI2
VarBoolFromUI1
SafeArrayAllocData
VarDateFromUdate
VarDateFromDisp
VarCyMulI4
SafeArrayGetElemsize
VarUdateFromDate
VarCyFromUI1
VarI1FromCy
VarRound
VariantCopy
CreateTypeLib2
VarBoolFromUI2
SysAllocString
VarDateFromI4
VarIdiv
OleCreatePropertyFrame
SysAllocStringLen
VARIANT_UserFree
QueryPathOfRegTypeLi
VarDateFromI1
VariantClear
VarI1FromR4
VarI4FromCy
VarUI4FromStr
SafeArrayGetRecordInfo
VariantChangeTypeEx
VarFormatDateTime
LPSAFEARRAY_UserSize
VarUI2FromBool
VarAdd
GetActiveObject
SafeArrayDestroyData
RegisterActiveObject
VarR4FromDisp
OACreateTypeLib2
VarUI1FromDisp
VarI4FromDec
SysFreeString
VarR8FromUI2
SafeArrayCreate
VarR4FromBool
VarBstrFromUI4
VarDecRound
VarDiv
VarI4FromI1
VarR4FromR8
OleLoadPicture
VariantChangeType
SysStringByteLen
VarUI4FromI2
VarDateFromUI1
VarUI4FromCy
VarBstrCmp
VarFormatPercent
VarUI1FromI2
CreateDispTypeInfo
VarR8FromI1
LoadRegTypeLi
VarI1FromUI1
VarBstrFromI1
SetErrorInfo
VarI4FromI2
VarI1FromStr
VarDateFromUI4
VarDecFromUI1
VarCyFromStr
VarBoolFromR8
OleLoadPicturePath
VarI1FromDate
VarUI1FromUI2
VarDateFromUI2
VarI2FromUI1
BSTR_UserFree
OleSavePictureFile
VARIANT_UserMarshal
VarUI4FromR4
VarDecFromUI2
VarImp
VarCmp
VarBoolFromDec
LPSAFEARRAY_UserUnmarshal
VarI2FromUI4
VarDateFromI2
VectorFromBstr
SystemTimeToVariantTime
OleCreatePropertyFrameIndirect
VarUI2FromDec
VarSu
VarBoolFromR4
VarR4FromStr
VarUI2FromUI1
LoadTypeLi
VarDecFromI2
SafeArrayAccessData
SafeArrayCopy
VARIANT_UserUnmarshal
VarCyFromDec
VarDateFromCy
VarCyFromR8
SysReAllocStringLen
imm32
ImmGetStatusWindowPos
ImmGetCandidateListCountA
ImmGetDescriptionW
ImmCreateIMCC
ImmRequestMessageA
ImmGetCandidateListA
ImmDestroySoftKeyboard
ImmGetContext
ImmGetHotKey
ImmInstallIMEW
ImmGetRegisterWordStyleA
ImmGetConversionStatus
ImmEnumRegisterWordA
ImmUnlockIMC
ImmIsUIMessageA
ImmAssociateContext
ImmGetRegisterWordStyleW
ImmGetIMCLockCount
ImmSetCompositionWindow
ImmSetStatusWindowPos
ImmSetConversionStatus
ImmSetCandidateWindow
ImmGetConversionListW
ImmGetDefaultIMEWnd
ImmGetConversionListA
ImmSimulateHotKey
ImmGetProperty
ImmUnlockIMCC
ImmDisableIME
ImmIsIME
ImmGetImeMenuItemsW
ImmShowSoftKeyboard
ImmLockIMCC
ImmEnumRegisterWordW
ImmConfigureIMEA
ImmGetCompositionWindow
ImmConfigureIMEW
ImmSetOpenStatus
ImmGetIMCCLockCount
ImmRequestMessageW
ImmAssociateContextEx
ImmSetHotKey
ImmGetCandidateWindow
ImmSetCompositionStringA
ImmDestroyContext
ImmUnregisterWordA
ImmReleaseContext
ImmGetGuideLineA
ImmGetDescriptionA
ImmCreateContext
ImmCreateSoftKeyboard
ImmEscapeA
ImmNotifyIME
ImmGetIMCCSize
ImmRegisterWordA
ImmSetCompositionFontA
ImmGetCompositionStringW
ImmEnumInputContext
ImmGetCompositionStringA
ImmGetVirtualKey
ImmGetCompositionFontA
ImmEscapeW
ImmGetCandidateListW
ImmGetImeMenuItemsA
ImmGetOpenStatus
ImmGetGuideLineW
ImmInstallIMEA
ImmGetIMEFileNameW
ImmGetCandidateListCountW
ImmIsUIMessageW
ImmSetCompositionFontW
ImmRegisterWordW
ImmDestroyIMCC
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
n2 Size: 249KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ