Static task
static1
Behavioral task
behavioral1
Sample
3174baf31e6cc7b415a6fb4c323eb081_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3174baf31e6cc7b415a6fb4c323eb081_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3174baf31e6cc7b415a6fb4c323eb081_JaffaCakes118
-
Size
851KB
-
MD5
3174baf31e6cc7b415a6fb4c323eb081
-
SHA1
3ab5c4149c9c5140c6abc3d31be4798eaa3489ea
-
SHA256
65b0b9aff0493e8fcb7d2d2dc75d92f1771397bd8d77a33c31435d9e33d03435
-
SHA512
3fa385c27462485c4b543423e5143582c5b93de1c61def8db29a659546ee88ed54b8b4cd93b9aa0e87747a3326de46060d7888542d796ef8104f916bc390e84d
-
SSDEEP
24576:TLpRkMsEAJz4AbWI5vNvO2xNhYW4krVxcL6AhWf:0ZJz4ACqvNvO2xNhiaQL6Lf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3174baf31e6cc7b415a6fb4c323eb081_JaffaCakes118
Files
-
3174baf31e6cc7b415a6fb4c323eb081_JaffaCakes118.exe windows:5 windows x86 arch:x86
64f3c14fec54be99c7ddd718023277ce
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
PfxInsertPrefix
RtlCreateUserSecurityObject
NtQueryInstallUILanguage
RtlSetDaclSecurityDescriptor
NtQueryKey
RtlUnicodeStringToOemSize
RtlEnlargedUnsignedDivide
_ui64toa
RtlEnlargedIntegerMultiply
NtResetWriteWatch
ZwSetDefaultLocale
NtCreatePort
RtlInitializeResource
RtlIsDosDeviceName_U
RtlAcquirePebLock
_snwprintf
RtlFindLeastSignificantBit
RtlQueryHeapInformation
RtlOpenCurrentUser
RtlSubtreePredecessor
oleacc
GetRoleTextW
CreateStdAccessibleProxyA
GetOleaccVersionInfo
LresultFromObject
CreateStdAccessibleProxyW
WindowFromAccessibleObject
AccessibleObjectFromWindow
ObjectFromLresult
GetRoleTextA
AccessibleObjectFromEvent
AccessibleChildren
CreateStdAccessibleObject
IID_IAccessibleHandler
AccessibleObjectFromPoint
LIBID_Accessibility
GetStateTextA
GetStateTextW
IID_IAccessible
msdart
?ConvertExclusiveToShared@CLKRLinearHashTable@@QBEXXZ
?_CmpExch@CReaderWriterLock3@@AAE_NJJ@Z
?SetSpinCount@CReaderWriterLock@@QAE_NG@Z
MpGetHeapHandle
MpHeapFree
?ValidSignature@CLKRHashTable@@QBE_NXZ
??1CLKRLinearHashTable@@QAE@XZ
?IsReadUnlocked@CReaderWriterLock2@@QBE_NXZ
?WriteLock@CReaderWriterLock@@QAEXXZ
?WriteLock@CSmallSpinLock@@QAEXXZ
?IsWin98@CMdVersionInfo@@SAHXZ
UMSEnterCSWraper
?Unlock@CLockedSingleList@@QAEXXZ
?RemoveHead@CLockedDoubleList@@QAEQAVCListEntry@@XZ
?ReadOrWriteUnlock@CSpinLock@@QAEX_N@Z
?_Expand@CLKRLinearHashTable@@AAE?AW4LK_RETCODE@@XZ
?_DeleteIf@CLKRLinearHashTable@@AAEKP6G?AW4LK_PREDICATE@@PBXPAX@Z1AAW42@@Z
?IsReadUnlocked@CLKRLinearHashTable@@QBE_NXZ
?WriteLock@CLKRHashTable@@QAEXXZ
?DeleteIf@CLKRLinearHashTable@@QAEKP6G?AW4LK_PREDICATE@@PBXPAX@Z1@Z
?IsLocked@CLockedSingleList@@QBE_NXZ
?_ExtractKey@CLKRHashTable@@ABE?BKPBX@Z
?_CurrentThreadId@CReaderWriterLock3@@CGJXZ
MPInitializeCriticalSectionAndSpinCount
?TryReadLock@CSpinLock@@QAE_NXZ
?IsWin98orLater@CMdVersionInfo@@SAHXZ
?IsWriteUnlocked@CReaderWriterLock2@@QBE_NXZ
??1CDoubleList@@QAE@XZ
?IsWriteUnlocked@CLKRLinearHashTable@@QBE_NXZ
?GetSpinCount@CSmallSpinLock@@QBEGXZ
?ReadOrWriteLock@CSpinLock@@QAE_NXZ
?InsertTail@CDoubleList@@QAEXQAVCListEntry@@@Z
?ConvertSharedToExclusive@CSmallSpinLock@@QAEXXZ
?IsWinNT@CMdVersionInfo@@SAHXZ
?SetDefaultSpinAdjustmentFactor@CSpinLock@@SGXN@Z
?TryReadLock@CFakeLock@@QAE_NXZ
?SetDefaultSpinCount@CReaderWriterLock@@SGXG@Z
?sm_dblDfltSpinAdjFctr@CReaderWriterLock2@@1NA
?FindRecord@CLKRHashTable@@QBE?AW4LK_RETCODE@@PBX@Z
?_InsertThisIntoGlobalList@CLKRLinearHashTable@@AAEXXZ
?SetSpinCount@CReaderWriterLock2@@QAE_NG@Z
?sm_wDefaultSpinCount@CSmallSpinLock@@1GA
?InitializeVersionInfo@CMdVersionInfo@@CAHXZ
?_LockSpin@CSmallSpinLock@@AAEXXZ
?_ReadOrWriteUnlock@CLKRLinearHashTable@@ABEX_N@Z
?SetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SGXN@Z
?_ReadLockSpin@CReaderWriterLock@@AAEXXZ
?Pop@CLockedSingleList@@QAEQAVCSingleListEntry@@XZ
kernel32
GetFileInformationByHandle
GetVersionExA
IsBadStringPtrW
ReadConsoleOutputCharacterW
GetPrivateProfileSectionNamesW
Heap32First
GetGeoInfoW
LocalSize
GlobalSize
AddVectoredExceptionHandler
DebugActiveProcess
SetCalendarInfoW
Beep
GetConsoleAliasExesA
OpenMutexA
SetConsoleCursorPosition
LZSeek
VirtualAlloc
LoadLibraryA
GetDefaultCommConfigW
OpenProfileUserMapping
SleepEx
IsBadStringPtrA
GetConsoleDisplayMode
GetConsoleTitleA
GetVolumeNameForVolumeMountPointW
ReadFileEx
RemoveLocalAlternateComputerNameA
IsValidCodePage
GlobalFindAtomW
GetSystemDefaultUILanguage
SetCommBreak
EnumUILanguagesW
FreeConsole
GetCompressedFileSizeW
SetConsoleInputExeNameA
InitializeCriticalSectionAndSpinCount
CreateDirectoryA
SetVolumeMountPointA
GetConsoleAliasesA
ExpandEnvironmentStringsW
GetTickCount
BackupWrite
SetCurrentDirectoryA
VirtualAllocEx
Sections
.text Size: 724KB - Virtual size: 724KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ