Static task
static1
Behavioral task
behavioral1
Sample
30daf12ae3bbceb5a3593fb49cb57a4a_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
30daf12ae3bbceb5a3593fb49cb57a4a_JaffaCakes118.exe
Resource
win10v2004-20240708-en
General
-
Target
30daf12ae3bbceb5a3593fb49cb57a4a_JaffaCakes118
-
Size
829KB
-
MD5
30daf12ae3bbceb5a3593fb49cb57a4a
-
SHA1
3da47464660901dc426b8dc2a95b3dd99f9fdb41
-
SHA256
51ec2a5ca7624f4afce7f2b8195e1c063a597e3519817409c6cfcfc72ffb8009
-
SHA512
53766bb7f8b8dcc1a798c75d056e9dd4675afd890f7eb0ef6fbcb310e0d1bad782032025cd683551a18ef82bcd1dba512dcc2e476f8f37641053a29ca9619c4c
-
SSDEEP
24576:puA04LuA1Sq0zfcmjNGLussl7arqirGrewW:UApKZq0JhGLurlDirGrZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30daf12ae3bbceb5a3593fb49cb57a4a_JaffaCakes118
Files
-
30daf12ae3bbceb5a3593fb49cb57a4a_JaffaCakes118.exe windows:5 windows x86 arch:x86
e4b07ca91e41657aef983eea1b81c08d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
NdrConformantStructMemorySize
NdrpGetTypeGenCookie
NdrServerUnmarshall
RpcBindingInqAuthInfoA
RpcBindingSetAuthInfoW
NdrpMemoryIncrement
RpcMgmtEnableIdleCleanup
NdrNsGetBuffer
NdrpCreateProxy
NdrPointerUnmarshall
NdrConformantStringUnmarshall
RpcBindingReset
NdrServerInitializeUnmarshall
I_RpcServerInqTransportType
IUnknown_AddRef_Proxy
I_RpcTransIoCancelled
NdrUserMarshalUnmarshall
NdrEncapsulatedUnionFree
CStdStubBuffer_DebugServerRelease
long_from_ndr
NDRSContextUnmarshall2
long_array_from_ndr
RpcCancelThread
NdrClientContextUnmarshall
SimpleTypeMemorySize
I_RpcServerUseProtseq2W
NdrConformantVaryingStructUnmarshall
RpcBindingInqAuthInfoW
RpcServerUseProtseqIfExA
RpcMgmtEpEltInqNextA
NdrTypeUnmarshall
RpcTestCancel
I_RpcLogEvent
RpcNetworkInqProtseqsW
RpcStringBindingComposeW
NdrProxyErrorHandler
NdrMesTypeEncode2
NdrComplexArrayMemorySize
NdrpCreateStub
esent
JetMove@16
JetDupCursor
JetCreateInstance
JetResetCounter
JetCreateIndex2
JetDBUtilities
JetRegisterCallback
JetGetAttachInfo
JetGetDatabaseFileInfo
JetMakeKey
JetInit
JetSetCurrentIndex
JetEnumerateColumns
JetOSSnapshotFreeze
JetDeleteColumn2
JetGetLogInfo
JetGetTableInfo
JetInit3
JetBackupInstance
JetBeginTransaction
JetSnapshotStart
JetGetVersion
JetRetrieveColumn
JetDelete
JetGetDatabaseInfo
JetOSSnapshotThaw
JetBackup
JetDefragment
JetBeginExternalBackupInstance
JetCloseDatabase@12
JetGotoBookmark
JetRetrieveColumn@32
JetStopServiceInstance
JetBeginExternalBackup
JetTerm@4
JetGetTruncateLogInfoInstance
JetGetObjectInfo
JetDelete@8
mscat32
CryptCATPutCatAttrInfo
CryptCATGetAttrInfo
CryptCATAdminReleaseContext
CryptCATCDFEnumMembers
CryptCATStoreFromHandle
CryptCATVerifyMember
CryptCATCatalogInfoFromContext
CryptCATCDFOpen
CryptCATAdminReleaseCatalogContext
CryptCATCDFEnumAttributesWithCDFTag
CryptCATPersistStore
CryptCATOpen
CryptCATCDFEnumAttributes
CryptCATAdminAddCatalog
CryptCATAdminAcquireContext
DllRegisterServer
CryptCATGetMemberInfo
CryptCATPutMemberInfo
MsCatFreeHashTag
DllUnregisterServer
CryptCATEnumerateAttr
CryptCATGetCatAttrInfo
CryptCATEnumerateCatAttr
CryptCATAdminEnumCatalogFromHash
CryptCATCDFClose
IsCatalogFile
CatalogCompactHashDatabase
CryptCATClose
CryptCATCDFEnumMembersByCDFTag
CryptCATPutAttrInfo
MsCatConstructHashTag
ntdll
RtlInitUnicodeStringEx
atoi
ZwReadRequestData
ZwCreateMailslotFile
NtUnloadDriver
NtImpersonateClientOfPort
wcscpy
_CIsin
NtCreateProfile
RtlSetSecurityDescriptorRMControl
NtListenPort
_lfind
RtlCreateAndSetSD
_ltoa
NtStopProfile
RtlAddAuditAccessAceEx
ZwQueryInformationToken
RtlEnlargedUnsignedMultiply
ZwRequestPort
NtQueryBootOptions
islower
_wcslwr
RtlFindActivationContextSectionString
ZwWriteRequestData
NtMapUserPhysicalPages
RtlIsTextUnicode
NtMakePermanentObject
NtSuspendProcess
ZwCompressKey
RtlValidSecurityDescriptor
ZwQueueApcThread
msvcp60
??4?$_Ctr@M@std@@QAEAAV01@ABV01@@Z
?do_grouping@?$_Mpunct@G@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?_Getcat@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIXZ
?truename@?$numpunct@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?_Isinf@?$_Ctr@N@std@@SA_NN@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Getcat@?$moneypunct@D$0A@@std@@SAIXZ
??4?$basic_ios@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
?_Init@?$messages@G@std@@IAEXABV_Locinfo@2@@Z
??1_Locinfo@std@@QAE@XZ
_LXbig
??_F?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?infinity@?$numeric_limits@M@std@@SAMXZ
??_8?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B@
??4ios_base@std@@QAEAAV01@ABV01@@Z
??0runtime_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?max@?$numeric_limits@J@std@@SAJXZ
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXF@Z
?_Iscloc@locale@std@@QBE_NXZ
?infinity@?$numeric_limits@I@std@@SAIXZ
??Dstd@@YA?AV?$complex@M@0@ABV10@0@Z
?sputbackc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
_FNan
??9locale@std@@QBE_NABV01@@Z
_LDscale
_Getcvt
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBEHXZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0PBD1@Z
?denorm_min@?$numeric_limits@C@std@@SACXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?infinity@?$numeric_limits@G@std@@SAGXZ
?round_error@?$numeric_limits@D@std@@SADXZ
??0locale@std@@QAE@W4_Uninitialized@1@@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
??0_Timevec@std@@QAE@PAX@Z
sqlwoa
_GetWindowText@12
_GetObject@12
_LoadString@16
_CharLower@4
_GetClassInfo@12
_GetWindowTextLength@4
_GetModuleFileName@12
_MAKEINTRESOURCE@4
_CreateFontIndirect@4
_FindResource@12
AllocConvertMultiSZNameToA
_PeekMessage@20
_LoadMenu@8
_GetDlgItemText@16
_GetVersionEx@4
_CreateWindowEx@48
_GetTextExtentPoint@16
_GetWindowLong@8
_GetTextExtentPoint32@16
ConvertMultiSZNameToW
_DefWindowProc@16
_LoadBitmap@8
_GetOpenFileName@4
_TranslateAccelerator@12
newMultiByteFromWideChar
_CreateFile@28
_SendMessage@16
_CommDlg_OpenSave_GetFolderPath@12
_RemoveProp@8
_GetProp@8
_MoveFile@8
_FreeEnvironmentStrings@4
_GetTextMetrics@8
_CommDlg_OpenSave_GetSpec@12
_SetWindowText@8
comdlg32
FindTextW
LoadAlterBitmap
GetSaveFileNameW
ReplaceTextA
CommDlgExtendedError
FindTextA
PrintDlgW
GetFileTitleW
dwLBSubclass
GetOpenFileNameA
WantArrows
ChooseFontW
dwOKSubclass
ChooseFontA
PrintDlgExW
PrintDlgExA
PrintDlgA
PageSetupDlgA
Ssync_ANSI_UNICODE_Struct_For_WOW
ReplaceTextW
ChooseColorW
GetSaveFileNameA
ChooseColorA
GetOpenFileNameW
GetFileTitleA
query
?VT_VARIANT_EQ@@YGHABUtagPROPVARIANT@@0@Z
?GetCD@CCatState@@QAEPBGXZ
??0SStorageObject@@QAE@PAVPStorageObject@@@Z
?SetPhrase@CContentRestriction@@QAEXPBG@Z
?UnMarshall@CDbParameter@@QAEHAAVPDeSerStream@@@Z
??0CDFA@@QAE@PBGAAVCTimeLimit@@E@Z
?Open@COLEPropManager@@QAEHABVCFunnyPath@@@Z
CIBuildQueryTree
?RemoveScope@CCatalogAdmin@@QAEXPBG@Z
?PeekULong@CMemDeSerStream@@UAEKXZ
?DisableNotification@CRegNotify@@QAEXXZ
?DeleteRecord@CPropStoreManager@@QAEXK@Z
??0CStandardPropMapper@@QAE@XZ
?AcquireRead@CPropertyStore@@AAEXAAVCReadWriteLockRecord@@@Z
?GetOleDBErrorInfo@@YGJPAUIUnknown@@ABU_GUID@@KIPAUtagERRORINFO@@PAPAUIErrorInfo@@@Z
?QueryCatalogAdmin@CMachineAdmin@@QAEPAVCCatalogAdmin@@PBG@Z
LoadBinaryFilter
?MakeMetadataICommand@@YGJPAPAUIUnknown@@W4CiMetaData@@PBG2PAU1@@Z
?Marshall@CDbColId@@QBEXAAVPSerStream@@@Z
??0CFwAsyncWorkItem@@QAE@AAVCWorkManager@@AAVCWorkQueue@@@Z
?AddArg@CEventItem@@QAEXPBG@Z
?CloseRecord@CPropStoreManager@@QAEXPAVCCompositePropRecordForWrites@@@Z
?SetLPWSTR@CStorageVariant@@QAEXPBGI@Z
?GetUserHdrInfo@CIndexTable@@QAEXAAIAAH@Z
CIMakeICommand
?Remove@CColumns@@QAEXI@Z
?GetCGIVariable@CWebServer@@QAEHPBDAAV?$XArray@G@@AAK@Z
?ReadProperty@CPropStoreManager@@QAEHKKAAUtagPROPVARIANT@@@Z
?ReadProperty@CPropStoreManager@@QAEHAAVCCompositePropRecord@@KPAUtagPROPVARIANT@@PAI@Z
?BuildRegistryScopesKey@@YGXAAV?$XArray@G@@PBG@Z
certcli
CASetCertTypeExtension
CAGetCertTypeProperty
CASetCAExpiration
CASetCASecurity
CAEnumFirstCA
CACertTypeAccessCheck
CASetCertTypeProperty
CACertTypeSetSecurity
GetProxyDllInfo
CACertTypeQuery
CAAccessCheck
CAOIDFreeLdapURL
CACertTypeGetSecurity
CACreateLocalAutoEnrollmentObject
CAFindByIssuerDN
CARemoveCACertificateType
CASetCertTypeFlagsEx
CACertTypeRegisterQuery
CAOIDGetLdapURL
CAGetCASecurity
CASetCertTypeExpiration
CAGetCertTypeFlagsEx
CAGetCertTypeExpiration
CACreateAutoEnrollmentObjectEx
CAAddCACertificateType
CAGetCAProperty
CAOIDCreateNew
CAEnumNextCA
kernel32
OpenEventA
IsBadCodePtr
LocalHandle
GetProfileIntA
GetCurrentDirectoryW
GetConsoleInputWaitHandle
IsBadReadPtr
lstrcmp
MapUserPhysicalPages
DeleteVolumeMountPointW
ExpandEnvironmentStringsW
GetComputerNameExW
ReleaseMutex
LoadLibraryA
GlobalHandle
GetShortPathNameA
WriteConsoleOutputCharacterA
InitializeCriticalSection
GetACP
CopyFileExA
WriteProfileSectionW
DeleteFiber
GetNumaHighestNodeNumber
SetTapePosition
SetConsoleCursorMode
EnumCalendarInfoA
CreateIoCompletionPort
GetCPInfoExW
GetConsoleHardwareState
RegisterConsoleIME
EnumResourceTypesA
LocalCompact
FlushConsoleInputBuffer
GetTapeStatus
GetConsoleCommandHistoryLengthA
SetLocaleInfoW
SetConsoleActiveScreenBuffer
AllocConsole
ReadConsoleInputA
GetPrivateProfileIntA
FindFirstFileExW
GetSystemTimeAsFileTime
ConvertFiberToThread
VirtualAlloc
SetTapeParameters
GetCommConfig
GlobalAlloc
GetThreadPriority
Sections
.text Size: 109KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 146KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 565KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ