Static task
static1
Behavioral task
behavioral1
Sample
3570e429401a91e49c9f78a63b0dfd30_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3570e429401a91e49c9f78a63b0dfd30_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3570e429401a91e49c9f78a63b0dfd30_JaffaCakes118
-
Size
74KB
-
MD5
3570e429401a91e49c9f78a63b0dfd30
-
SHA1
ce704faac303206fcf847fc0eac825871f3f3eac
-
SHA256
da7888d98bd5231810b3c30b957bb442a46a91649df5d6b77b5d09958d83d4f5
-
SHA512
e35e3558c7434533e6d37872de997c190219b4b89520cc542b64f48474a8de99b7d18774fc3e408852283952d339938bb7edec43be40295a2216d56851d3675e
-
SSDEEP
1536:T6CHQGWSGy/p7MocYIlqNxzWX0ITXi/m6eR5D2KdXhsL/H:hHQGWJCMdTlqNxo0mX4m6KDzDszH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3570e429401a91e49c9f78a63b0dfd30_JaffaCakes118
Files
-
3570e429401a91e49c9f78a63b0dfd30_JaffaCakes118.exe windows:1 windows x86 arch:x86
5a727179ec449322f39d51b67de083fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ifsutil
?IsFrontEndPresent@AUTOREG@@SGEPBVWSTRING@@0@Z
??1CANNED_SECURITY@@UAE@XZ
?Initialize@NUMBER_SET@@QAEEXZ
?DumpHashTable@SPARSE_SET@@QAEXXZ
??1SECRUN@@UAE@XZ
?Read@SECRUN@@UAEEXZ
??0DIGRAPH_EDGE@@QAE@XZ
?CheckAndRemove@SPARSE_SET@@QAEEVBIG_INT@@PAE@Z
?Initialize@DP_DRIVE@@QAEEPBVWSTRING@@PAVMESSAGE@@EEG@Z
?QueryFreeDiskSpace@IFS_SYSTEM@@SGEPBVWSTRING@@PAVBIG_INT@@@Z
?Initialize@VOL_LIODPDRV@@IAEEPBVWSTRING@@0PAVSUPERAREA@@PAVMESSAGE@@E@Z
?SendSonyMSTestUnitReadyCmd@DP_DRIVE@@QAEEPAU_SENSE_DATA@@@Z
?Initialize@READ_CACHE@@QAEEPAVIO_DP_DRIVE@@K@Z
?Format@VOL_LIODPDRV@@QAE?AW4FORMAT_ERROR_CODE@@PBVWSTRING@@PAVMESSAGE@@KKK@Z
?QueryPageSize@IFS_SYSTEM@@SGKXZ
?Set@BIG_INT@@QAEXEPBE@Z
?RemoveAll@SPARSE_SET@@QAEEXZ
?NtDriveNameToDosDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z
?QueryNtfsVersion@IFS_SYSTEM@@SGEPAE0PAVLOG_IO_DP_DRIVE@@PAX@Z
?CheckValidSecurityDescriptor@IFS_SYSTEM@@SGEKPAU_SECURITY_DESCRIPTOR@@@Z
?GetMessageW@SUPERAREA@@QAEPAVMESSAGE@@XZ
?SendSonyMSInquiryCmd@DP_DRIVE@@QAEEPAUSONY_MS_INQUIRY_DATA@@@Z
??0SPARSE_SET@@QAE@XZ
?DosDriveNameToNtDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z
?AddNext@NUMBER_SET@@QAEEVBIG_INT@@@Z
?Verify@IO_DP_DRIVE@@QAEEVBIG_INT@@0@Z
?IsArcSystemPartition@IFS_SYSTEM@@SGEPBVWSTRING@@PAE@Z
??1TLINK@@UAE@XZ
?RemoveAll@NUMBER_SET@@QAEEXZ
?Remove@NUMBER_SET@@QAEEVBIG_INT@@0@Z
?QueryRecommendedMediaType@DP_DRIVE@@QBE?AW4_MEDIA_TYPE@@XZ
?Initialize@DIGRAPH@@QAEEK@Z
?QueryParents@DIGRAPH@@QBEEKPAVNUMBER_SET@@@Z
??0READ_CACHE@@QAE@XZ
?InvalidateVolume@IO_DP_DRIVE@@QAEEXZ
?SetAutochkTimeOut@VOL_LIODPDRV@@SGEK@Z
?DoesIntersectSet@NUMBER_SET@@QBEEVBIG_INT@@0@Z
?QuerySize@TLINK@@QBEGXZ
?Initialize@SPARSE_SET@@QAEEXZ
?AddVolumeName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?ComputeVolId@SUPERAREA@@SGKK@Z
vdmdbg
VDMKillWOW
VDMGlobalNext
VDMGetThreadSelectorEntry
VDMSetThreadContext
VDMEnumTaskWOW
VDMGlobalFirst
VDMGetDbgFlags
VDMIsModuleLoaded
VDMGetThreadContext
VDMDetectWOW
VDMGetSegmentInfo
VDMSetDbgFlags
VDMGetSegtablePointer
VDMGetPointer
VDMProcessException
VDMBreakThread
VDMEnumProcessWOW
VDMModuleFirst
VDMGetAddrExpression
VDMGetContext
VDMGetSelectorModule
VDMTerminateTaskWOW
VDMEnumTaskWOWEx
VDMSetContext
VDMGetModuleSelector
VDMModuleNext
VDMGetSymbol
VDMStartTaskInWOW
kernel32
SetThreadContext
QueueUserAPC
LoadLibraryA
GetProfileStringW
GetNumaAvailableMemoryNode
FindNextFileW
LZDone
GetNamedPipeInfo
lstrcatA
CommConfigDialogA
CreateNamedPipeW
GetConsoleDisplayMode
DeleteFileA
VirtualAlloc
GetStartupInfoW
CloseProfileUserMapping
LocalReAlloc
CreateIoCompletionPort
GetTickCount
GetEnvironmentStrings
GetProcessTimes
GlobalAlloc
CreateMutexA
DeviceIoControl
EnumCalendarInfoW
HeapSummary
WriteTapemark
SetConsoleNumberOfCommandsA
CreateSemaphoreA
WriteConsoleInputVDMA
InitializeCriticalSectionAndSpinCount
UpdateResourceA
ReleaseMutex
WritePrivateProfileStructW
HeapReAlloc
GetSystemTimeAdjustment
IsDebuggerPresent
IsDBCSLeadByte
lstrcpynW
EnumTimeFormatsA
GetConsoleAliasExesLengthW
GetConsoleScreenBufferInfo
LocalAlloc
SetLocaleInfoW
MapViewOfFile
ExpandEnvironmentStringsW
GetVolumePathNameA
msvcirt
??_7stdiobuf@@6B@
?setbuf@streambuf@@UAEPAV1@PADH@Z
??_Dostream_withassign@@QAEXXZ
?close@filebuf@@QAEPAV1@XZ
?ebuf@streambuf@@IBEPADXZ
?sh_none@filebuf@@2HB
??_Gexception@@UAEPAXI@Z
?pbackfail@streambuf@@UAEHH@Z
??0strstreambuf@@QAE@H@Z
?sync@streambuf@@UAEHXZ
??5istream@@QAEAAV0@AAF@Z
??4istream@@IAEAAV0@ABV0@@Z
?put@ostream@@QAEAAV1@D@Z
?lockbuf@ios@@QAAXXZ
??4istream_withassign@@QAEAAVistream@@ABV1@@Z
??_Diostream@@QAEXXZ
?x_maxbit@ios@@0JA
?get@istream@@QAEHXZ
??_Gstrstream@@UAEPAXI@Z
?unsetf@ios@@QAEJJ@Z
??5istream@@QAEAAV0@AAC@Z
??4istrstream@@QAEAAV0@ABV0@@Z
??0filebuf@@QAE@H@Z
??0istream@@IAE@ABV0@@Z
?setlock@streambuf@@QAEXXZ
?rdbuf@ostrstream@@QBEPAVstrstreambuf@@XZ
??0ifstream@@QAE@PBDHH@Z
??0ofstream@@QAE@ABV0@@Z
?lock@ios@@QAAXXZ
?unlockc@ios@@KAXXZ
?get@istream@@QAEAAV1@AAC@Z
??4ostream_withassign@@QAEAAV0@ABV0@@Z
??_Gstreambuf@@UAEPAXI@Z
?getline@istream@@QAEAAV1@PAEHD@Z
??5istream@@QAEAAV0@AAD@Z
?setp@streambuf@@IAEXPAD0@Z
user32
GetMenuItemInfoA
GetWindowTextLengthW
IMPQueryIMEA
PrivateExtractIconsW
OpenWindowStationA
DdeUnaccessData
FindWindowExA
ReleaseDC
GetMenuItemRect
EnumWindowStationsW
ValidateRgn
ChangeMenuW
TileChildWindows
GetDoubleClickTime
CreateWindowStationW
FindWindowA
LoadMenuW
InvertRect
LoadImageA
IsCharUpperA
DdeCreateDataHandle
WCSToMBEx
GetInternalWindowPos
AdjustWindowRect
DrawFrame
uniplat
UnimodemQueueUserAPC
UnimodemWriteFileEx
UmPlatformDeinitialize
SetUnimodemTimer
StartMonitorThread
FreeUnimodemTimer
AllocateOverStructEx
CallBeginning
UnimodemNotifyTSP
UmPlatformInitialize
UnimodemReadFileEx
CreateOverStructPool
CreateUnimodemTimer
MonitorHandle
SyncDeviceIoControl
ResetCallCount
StopMonitoringHandle
CallEnding
CancelUnimodemTimer
DestroyOverStructPool
WinntIsWorkstation
FreeOverStruct
UnimodemDeviceIoControlEx
StopMonitorThread
UnimodemWaitCommEventEx
ReinitOverStruct
ir50_32
AboutDialogProc
DllMain
ConfigureDialogProc
DriverProc
DllGetClassObject
Sections
.text Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ