Static task
static1
Behavioral task
behavioral1
Sample
3e16ed2652e48c6b3b2b3cf4160fcb50_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3e16ed2652e48c6b3b2b3cf4160fcb50_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3e16ed2652e48c6b3b2b3cf4160fcb50_JaffaCakes118
-
Size
385KB
-
MD5
3e16ed2652e48c6b3b2b3cf4160fcb50
-
SHA1
65b545e5134921786434caad5a94119fbc188905
-
SHA256
d49dbe190464a1b11e8ee4804899f232904ec6f63deba531de4f5ceecab96f53
-
SHA512
5677afdf545e31c50e6872eb9c3e9f67cf3da805d2e0e6535ee67439f997e3ad3de2c9f594c56cdc877de2e0c04cddd02e8353f00ce87143a4824f62fad3f333
-
SSDEEP
6144:qUsqpnvT5lOBz6g4RobLcCpJSTkmgvsYA9fblYO98kdjI0bnCcxd+UzNTPxgQBAs:fsqpnvT5lNobRpJFYYOlc0lxohQBAs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e16ed2652e48c6b3b2b3cf4160fcb50_JaffaCakes118
Files
-
3e16ed2652e48c6b3b2b3cf4160fcb50_JaffaCakes118.exe windows:5 windows x86 arch:x86
1bbffff9ed005892ac30148532a5f04d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
dnsapi
DnsUnicodeToUtf8
DnsGetDomainName
Dns_InitializeWinsock
DnsNotifyResolverEx
DnsIsAMailboxType
DnsNameCompareEx_UTF8
DnsGetLastFailedUpdateInfo
BreakRecordsIntoBlob
Dns_OpenTcpConnectionAndSend
DnsAsyncRegisterHostAddrs
DnsAllocateRecord
DnsReplaceRecordSetW
DnsQueryExA
DnsUpdate
Dns_WriteRecordStructureToPacketEx
DnsAsyncRegisterInit
DnsFlushResolverCacheEntry_W
Dns_RecvTcp
DnsDhcpSrvRegisterHostName
DnsQueryConfig
Dns_CloseSocket
DnsSetConfigDword
DnsDhcpSrvRegisterInitialize
NetInfo_IsForUpdate
DnsWriteReverseNameStringForIpAddress
Dns_CloseConnection
DnsRecordTypeForName
Dns_SetRecordDatalength
Dns_ReadRecordStructureFromPacket
Dns_AddRecordsToMessage
DnsCreateStringCopy
DnsNameCompare_UTF8
DnsValidateName_A
DnsFlushResolverCacheEntry_UTF8
DnsRecordCompare
DnsAcquireContextHandle_W
DnsFindAuthoritativeZone
DnsRecordSetCompare
NetInfo_Free
Dns_ParsePacketRecord
query
?SetNumberOfSortProps@CCatState@@QAEXI@Z
?LokNewWorkId@CPropertyStore@@AAEKKHH@Z
?QueryInterface@CEnumWorkid@@UAGJABU_GUID@@PAPAX@Z
??0CAllocStorageVariant@@QAE@PBU_GUID@@AAVPMemoryAllocator@@@Z
?SkipULong@CMemDeSerStream@@UAEXXZ
?GetPropInfo@CEmptyPropertyList@@QAEHABVCDbColId@@PAPBGPAGPAI@Z
??0CMachineAdmin@@QAE@PBGH@Z
?ReadProperty@CPropStoreManager@@QAEHAAVCCompositePropRecord@@KAAUtagPROPVARIANT@@PAEPAI@Z
??1CPropertyList@@UAE@XZ
?SetColumn@CCatState@@QAEXPBGI@Z
??0CWorkQueue@@QAE@IW4WorkQueueType@0@@Z
?SetLPSTR@CStorageVariant@@QAEXPBDI@Z
??0CDbNatLangRestriction@@QAE@PBGABUtagDBID@@K@Z
?IsWaitingForDocument@CFilterDaemon@@QAEHXZ
??0CRequestClient@@QAE@PBGPAUIDBProperties@@@Z
?AddChild@CNodeRestriction@@QAEXPAVCRestriction@@AAI@Z
??8CDbColId@@QBEHABV0@@Z
?My_wcstoui64@@YA_KPBGPAPAGH@Z
?UnMarshall@CDbContentVector@@QAEHAAVPDeSerStream@@@Z
?ReadPrimaryProperty@CPropStoreManager@@QAEHKKAAUtagPROPVARIANT@@@Z
?ClearList@CPropertyList@@QAEXXZ
?LookupSDID@CSdidLookupTable@@QAEKPAXK@Z
?QueryInterface@CEnumString@@UAGJABU_GUID@@PAPAX@Z
?DisableNotification@CRegNotify@@QAEXXZ
?AddDir@CCatState@@QAEXAAV?$XPtrST@G@@@Z
?GetAllEntries@CPropertyList@@UAEJPAPAVCPropEntry@@K@Z
?Release@CImpersonateRemoteAccess@@QAEXXZ
??0CCatState@@QAE@XZ
?EnumPropInfo@CEmptyPropertyList@@UAGJKPAPBGPAPAUtagDBID@@PAGPAI@Z
?GetDouble@CMemDeSerStream@@UAENXZ
?GrowBuffer@CVirtualString@@AAEXK@Z
?Next@CEnumWorkid@@UAGJKPAK0@Z
?AddArg@CEventItem@@QAEXPBG@Z
?CloseRecord@CPropStoreManager@@QAEXPAVCCompositePropRecordForWrites@@@Z
??0CMetaDataMgr@@QAE@HW4CiVRootTypeEnum@@KPBG@Z
?PutMaxValue@CValueNormalizer@@QAEXKAAKW4VARENUM@@@Z
?AddCachedProperty@CCatalogAdmin@@QAEXABVCFullPropSpec@@KKKH@Z
?Shutdown@CPropStoreManager@@QAEXXZ
?AddCatalog@CMachineAdmin@@QAEXPBG0@Z
?AcqRst@CRangeKeyRepository@@QAEPAVCRangeRestriction@@XZ
atmlib
ATMFontStatus
ATMGetBuildStr
ATMGetFontInfoW
ATMXYShowText
ATMGetOutline
ATMBeginFontChange
ATMFinish
ATMRemoveFont
ATMEnumFonts
ATMFontStatusW
ATMGetVersionExW
ATMAddFontExA
ATMBBoxBaseXYShowTextA
ATMAddFontExW
ATMRemoveFontA
ATMGetVersionExA
ATMBBoxBaseXYShowTextW
ATMFontAvailableA
ATMSetFlags
ATMGetPostScriptNameW
ATMGetMenuName
ATMAddFontA
ATMGetVersionEx
ATMEnumMMFontsA
ATMGetFontBBox
ATMGetOutlineW
ATMEnumMMFonts
ATMForceFontChange
ATMGetNtmFieldsA
ATMGetGlyphList
ATMGetFontPaths
ATMGetMenuNameA
ATMSelectObject
ATMMakePFM
ATMEndFontChange
ATMMakePFMW
ATMBBoxBaseXYShowText
ATMGetOutlineA
ATMGetPostScriptNameA
ATMXYShowTextA
kernel32
LocalHandle
SetFileApisToANSI
GetHandleContext
GlobalMemoryStatusEx
lstrcmpi
LocalAlloc
GetDiskFreeSpaceExW
GetConsoleCommandHistoryLengthW
GetConsoleCursorMode
CreateDirectoryA
CreateThread
SetHandleInformation
GetComPlusPackageInstallStatus
GetEnvironmentStringsW
CallNamedPipeA
lstrcmp
SetThreadLocale
ReplaceFileW
MulDiv
IsBadWritePtr
QueryPerformanceCounter
GetCurrentThread
UnlockFile
SetSystemTimeAdjustment
GenerateConsoleCtrlEvent
CreateActCtxW
GetVolumePathNamesForVolumeNameA
WaitForMultipleObjects
GetConsoleInputExeNameA
WideCharToMultiByte
IsValidLanguageGroup
FormatMessageA
Module32FirstW
GetConsoleCursorInfo
GlobalUnWire
Module32First
MoveFileExA
CreateMailslotW
SetComputerNameExA
_llseek
lstrlenA
CreateSocketHandle
IsValidCodePage
VirtualAlloc
RtlCaptureStackBackTrace
GetExitCodeProcess
LoadLibraryA
FindResourceW
olecli32
LeShow
BmChangeData
MfGetData
PbDraw
MfQueryBounds
OleEnumObjects
MfEqual
DibRelease
GenSetData
OleActivate
OleUnlockServer
OleQueryLinkFromClip
OleQueryOutOfDate
OleRelease
ErrSetUpdateOptions
OleClose
OleRename
ErrCopyFromLink
OleSavedClientDoc
GenSaveToStream
GenEnumFormat
LeReconnect
SetNextNetDrive
ErrObjectLong
OleQueryProtocol
GenRelease
OleSetHostNames
BmRelease
OleCreateFromClip
ObjQueryName
OleQueryBounds
DibGetData
LeCopy
WEP
PbCreateFromFile
ObjQuerySize
MfClone
LeSaveToStream
Sections
.text Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 126KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 517KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ