Static task
static1
Behavioral task
behavioral1
Sample
3c1715348ffd8db69bdd1baca2e8628f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3c1715348ffd8db69bdd1baca2e8628f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3c1715348ffd8db69bdd1baca2e8628f_JaffaCakes118
-
Size
488KB
-
MD5
3c1715348ffd8db69bdd1baca2e8628f
-
SHA1
6ba0568c88685e2e71abe5691c2704c27ad52c05
-
SHA256
a222bd3b5791dda8d520109bbd2d68d28578959be1920f76acba09fd9650a7c6
-
SHA512
87af94045b794b0bb79f6deed845ff1d21ade8261836d627a52e49a23e148a77992fff5f174fd2d41363f80480c4e0f929a692b942ff064f1c768dd29226e97f
-
SSDEEP
6144:Q4P3CU4DaR5F1CHf2L/N/LGq2FJUOE9fKsXC26xc12ZQX9snFgD+R:5Jlt1C/s/5L1oJWy8CWMiX+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c1715348ffd8db69bdd1baca2e8628f_JaffaCakes118
Files
-
3c1715348ffd8db69bdd1baca2e8628f_JaffaCakes118.exe windows:5 windows x86 arch:x86
26fd1634aefcefa3d30d56d2baeefc2f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
A_SHAInit
A_SHAUpdate
A_SHAFinal
MD5Final
MD5Update
MD5Init
I_ScSendTSMessage
RegSetKeySecurity
AddAccessAllowedAceEx
RegDeleteKeyW
RegOpenCurrentUser
CryptReleaseContext
CryptGetProvParam
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptSetHashParam
GetCurrentHwProfileW
CryptCreateHash
CryptAcquireContextW
CryptGenRandom
CryptDeriveKey
CryptSignHashW
CryptSetProvParam
CryptDestroyKey
CryptDecrypt
CryptEncrypt
CryptVerifySignatureW
CryptGetKeyParam
CryptGetUserKey
LsaNtStatusToWinError
CryptImportKey
LsaStorePrivateData
LsaRetrievePrivateData
RegCloseKey
RegQueryValueExW
RegOpenKeyW
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegOpenKeyExW
CreateProcessAsUserW
DuplicateTokenEx
CloseServiceHandle
ControlService
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
EqualSid
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteValueW
CredFree
CredDeleteW
CredEnumerateW
CopySid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetUserNameW
OpenThreadToken
ReportEventW
RegisterEventSourceW
EnumServicesStatusW
ImpersonateLoggedOnUser
RegQueryValueExA
CheckTokenMembership
DeregisterEventSource
LsaGetUserName
RevertToSelf
LookupAccountSidW
IsValidSid
SetTokenInformation
LogonUserW
LookupAccountNameW
OpenProcessToken
SynchronizeWindows31FilesAndWindowsNTRegistry
QueryWindows31FilesMigration
AdjustTokenPrivileges
SystemFunction036
RegQueryInfoKeyA
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetKernelObjectSecurity
QueryServiceConfigW
RegNotifyChangeKeyValue
LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy
AllocateLocallyUniqueId
authz
AuthzAccessCheck
AuthziFreeAuditEventType
AuthziInitializeAuditEvent
AuthziInitializeAuditParams
AuthziInitializeAuditEventType
AuthzFreeResourceManager
AuthzFreeAuditEvent
AuthziLogAuditEvent
AuthzInitializeResourceManager
AuthzFreeHandle
crypt32
CryptImportPublicKeyInfoEx
CertEnumCertificatesInStore
CertOpenStore
CertVerifySubjectCertificateContext
CertGetIssuerCertificateFromStore
CertAddCertificateContextToStore
CertFindExtension
CryptExportPublicKeyInfo
CertComparePublicKeyInfo
CertGetCertificateContextProperty
CryptDecryptMessage
CertCloseStore
CryptSignMessage
CryptImportPublicKeyInfo
CryptVerifyMessageSignature
CertCreateCertificateContext
CertDuplicateCertificateContext
CertSetCertificateContextProperty
CertFreeCertificateContext
gdi32
RemoveFontResourceW
AddFontResourceW
kernel32
LoadLibraryW
ReleaseSemaphore
CreateSemaphoreW
GetCurrentThread
WaitForSingleObjectEx
CreateThread
LoadResource
FindResourceW
SetThreadExecutionState
ResetEvent
GetComputerNameW
GetSystemDirectoryW
SetLastError
TransactNamedPipe
SetNamedPipeHandleState
GetTickCount
GetProfileStringW
GlobalGetAtomNameW
SetEnvironmentVariableW
VirtualLock
VirtualQuery
GetDriveTypeW
Beep
QueueUserWorkItem
LeaveCriticalSection
EnterCriticalSection
DisconnectNamedPipe
TerminateProcess
GetCurrentProcess
SearchPathW
lstrcatW
LocalReAlloc
ExpandEnvironmentStringsW
TerminateThread
ResumeThread
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
DeleteFileW
WriteProfileStringW
ReadFile
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
SetThreadPriority
SetPriorityClass
MoveFileExW
WaitForMultipleObjectsEx
GetExitCodeProcess
GetProcAddress
InterlockedExchange
SetTimerQueueTimer
GetComputerNameA
VerifyVersionInfoW
VerSetConditionMask
WriteFile
WaitNamedPipeW
WaitForMultipleObjects
ConnectNamedPipe
DuplicateHandle
OpenProcess
GetOverlappedResult
GetVersionExA
lstrcmpW
UnregisterWait
CreateNamedPipeW
CreateRemoteThread
CreateActCtxW
GetModuleFileNameW
SetErrorMode
SetUnhandledExceptionFilter
GetPrivateProfileStringW
LocalSize
VirtualAlloc
VirtualQueryEx
GetEnvironmentVariableW
DebugBreak
CreateFileA
InitializeCriticalSection
ProcessIdToSessionId
FindClose
FindFirstFileW
SetInformationJobObject
AssignProcessToJobObject
TerminateJobObject
PostQueuedCompletionStatus
PulseEvent
GetQueuedCompletionStatus
CreateIoCompletionPort
CreateJobObjectW
ActivateActCtx
DeactivateActCtx
InterlockedCompareExchange
LoadLibraryA
GetModuleHandleA
GetStartupInfoA
FreeLibrary
SleepEx
GetModuleHandleW
GetShortPathNameW
lstrcpynW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetUserDefaultLCID
GetTimeFormatW
WTSGetActiveConsoleSessionId
GetCurrentProcessId
GetCurrentThreadId
GetVersionExW
FormatMessageW
lstrcmpiW
GetProfileIntW
lstrcpyW
lstrlenW
Sleep
LocalAlloc
CreateEventW
CreateWaitableTimerW
CreateMutexW
OpenEventW
RegisterWaitForSingleObject
WaitForSingleObject
CreateProcessW
SetWaitableTimer
ReleaseMutex
SetEvent
UnregisterWaitEx
CloseHandle
GlobalAlloc
GlobalFree
GetLastError
LocalFree
GetVolumeInformationW
GetDriveTypeA
GetLogicalDriveStringsA
lstrlenA
lstrcpyA
MultiByteToWideChar
GetACP
WideCharToMultiByte
SystemTimeToFileTime
GetSystemTime
HeapAlloc
GetProcessHeap
LoadLibraryExW
HeapFree
GetSystemDefaultUILanguage
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
lstrcmpiA
GetFileSize
GetSystemInfo
GetExitCodeThread
SetThreadAffinityMask
GetProcessAffinityMask
SizeofResource
LockResource
FindResourceExW
GetSystemDirectoryA
SetFilePointer
OpenMutexW
CreateFileW
GlobalMemoryStatus
lstrcmpA
DelayLoadFailureHook
BaseInitAppcompatCacheSupport
OpenProfileUserMapping
CloseProfileUserMapping
BaseCleanupAppcompatCacheSupport
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
CreateSemaphoreA
CreateEventA
ExitProcess
VirtualFree
VirtualProtect
FlushInstructionCache
GetSystemTimeAsFileTime
msvcrt
wcsstr
wcsncpy
atoi
_wcsicmp
memmove
wcschr
wcsncat
swprintf
swscanf
_local_unwind2
wcscmp
free
malloc
_c_exit
wcslen
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_snwprintf
__p__fmode
__set_app_type
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_itow
_wtol
_strnicmp
sscanf
sprintf
_except_handler3
_controlfp
wcsncmp
_ftol
ceil
_wcsupr
wcscpy
__p__commode
wcscat
_exit
wcstok
nddeapi
ord613
ord612
ord611
ord603
ntdll
NtPowerInformation
NtSetSystemPowerState
NtRaiseHardError
RtlDeleteCriticalSection
NtOpenSymbolicLinkObject
NtReplyPort
NtCompleteConnectPort
NtReplyWaitReceivePort
NtAcceptConnectPort
NtCreatePort
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
NtLockProductActivationKeys
RtlTimeToTimeFields
NtUnmapViewOfSection
NtMapViewOfSection
NtOpenSection
NtQuerySymbolicLinkObject
NtQueryVolumeInformationFile
NtSetSecurityObject
RtlAdjustPrivilege
NtOpenFile
NtFsControlFile
RtlAllocateAndInitializeSid
RtlDestroyEnvironment
RtlFreeHeap
NtQueryInformationToken
NtShutdownSystem
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlCompareUnicodeString
RtlInitializeCriticalSection
RtlCreateEnvironment
RtlQueryEnvironmentVariable_U
RtlSetEnvironmentVariable
RtlAllocateHeap
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlGetDaclSecurityDescriptor
RtlCopySid
RtlLengthSid
NtSetInformationThread
NtDuplicateToken
NtDuplicateObject
RtlEqualSid
RtlSetDaclSecurityDescriptor
RtlInitUnicodeString
NtOpenKey
NtQueryValueKey
NtClose
RtlOpenCurrentUser
RtlCreateSecurityDescriptor
RtlAddAce
RtlCreateAcl
RtlNtStatusToDosError
NtSetInformationProcess
NtCreateEvent
NtCreatePagingFile
RtlDosPathNameToNtPathName_U
NtQuerySystemInformation
NtOpenDirectoryObject
RtlRegisterWait
RtlTimeToSecondsSince1980
NtQuerySystemTime
NtPrivilegeObjectAuditAlarm
NtPrivilegeCheck
NtOpenThreadToken
NtOpenProcessToken
RtlUnhandledExceptionFilter
NtQueryInformationProcess
DbgBreakPoint
RtlCheckProcessParameters
RtlSetThreadIsCritical
RtlSetProcessIsCritical
RtlInitString
NtInitiatePowerAction
DbgPrint
NtFilterToken
NtQueryInformationJobObject
NtOpenEvent
RtlGetAce
RtlQueryInformationAcl
NtQuerySecurityObject
NtAllocateLocallyUniqueId
profmap
InitializeProfileMappingApi
RemapAndMoveUserW
psapi
GetModuleBaseNameW
EnumProcessModules
EnumProcesses
regapi
RegDefaultUserConfigQueryW
RegUserConfigQuery
rpcrt4
RpcRevertToSelf
RpcFreeAuthorizationContext
RpcGetAuthorizationContextForClient
RpcServerListen
RpcImpersonateClient
RpcServerRegisterIfEx
UuidCreate
RpcServerRegisterIf
I_RpcMapWin32Status
NdrServerCall2
RpcServerUseProtseqEpW
secur32
LsaLookupAuthenticationPackage
LsaCallAuthenticationPackage
LsaRegisterLogonProcess
GetUserNameExW
setupapi
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
sfc_os
SfcIsFileProtected
user32
CheckDlgButton
LoadCursorW
SetCursor
SetFocus
EnumWindows
UnhookWindowsHook
SetWindowsHookW
GetWindowTextW
CallNextHookEx
DialogBoxParamW
GetWindowPlacement
SetLastErrorEx
GetSystemMenu
DeleteMenu
SetWindowPlacement
SetUserObjectInformationW
GetAsyncKeyState
PostThreadMessageW
SetUserObjectSecurity
CreateDesktopW
KillTimer
GetMessageTime
SetTimer
wvsprintfW
UnregisterHotKey
DialogBoxIndirectParamW
OpenInputDesktop
GetUserObjectInformationW
CloseDesktop
RegisterDeviceNotificationW
SetThreadDesktop
CreateWindowExW
GetMessageW
TranslateMessage
RegisterWindowMessageW
RegisterClassW
IsDlgButtonChecked
FindWindowW
MessageBoxW
SendNotifyMessageW
PostQuitMessage
MsgWaitForMultipleObjects
GetWindowRect
GetSystemMetrics
PeekMessageW
DispatchMessageW
SetProcessWindowStation
UpdateWindow
ShowWindow
SetWindowPos
PostMessageW
ExitWindowsEx
EnumDisplayMonitors
SystemParametersInfoW
GetDlgItem
SendMessageW
CreateDialogParamW
DestroyWindow
GetWindowLongW
GetDlgItemTextW
EndDialog
SetWindowLongW
LoadStringW
SetWindowTextW
SetDlgItemTextW
wsprintfW
wsprintfA
CloseWindowStation
LoadImageW
GetKeyState
GetParent
RegisterLogonProcess
RecordShutdownReason
LoadLocalFonts
SetLogonNotifyWindow
UnlockWindowStation
LockWindowStation
GetDesktopWindow
CreateWindowStationW
OpenDesktopW
SwitchDesktop
DefWindowProcW
SetForegroundWindow
MBToWCSEx
SetWindowStationUser
UpdatePerUserSystemParameters
RegisterHotKey
ReplyMessage
userenv
ord131
ord117
GetAllUsersProfileDirectoryW
WaitForUserPolicyForegroundProcessing
ord140
WaitForMachinePolicyForegroundProcessing
ord118
ord150
ord152
UnregisterGPNotification
DestroyEnvironmentBlock
CreateEnvironmentBlock
RegisterGPNotification
GetUserProfileDirectoryW
ord130
LoadUserProfileW
UnloadUserProfile
ord151
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winsta
WinStationQueryLogonCredentialsW
_WinStationWaitForConnect
WinStationSetInformationW
_WinStationNotifyLogoff
_WinStationNotifyLogon
WinStationCheckLoopBack
WinStationShutdownSystem
_WinStationCallback
WinStationNameFromLogonIdW
WinStationDisconnect
_WinStationFUSCanRemoteUserDisconnect
WinStationConnectW
_WinStationNotifyDisconnectPipe
WinStationReset
WinStationQueryInformationW
WinStationGetMachinePolicy
WinStationEnumerate_IndexedW
WinStationIsHelpAssistantSession
ws2_32
WSACleanup
getaddrinfo
WSAStartup
Sections
.text Size: 373KB - Virtual size: 372KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 9KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE