Static task
static1
Behavioral task
behavioral1
Sample
3ffe6fb409cebf30fb7cc668aec3d2a8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3ffe6fb409cebf30fb7cc668aec3d2a8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3ffe6fb409cebf30fb7cc668aec3d2a8_JaffaCakes118
-
Size
374KB
-
MD5
3ffe6fb409cebf30fb7cc668aec3d2a8
-
SHA1
05746facc023d469dbe43e97004c8a540e4bc185
-
SHA256
4e5e5c316232f8a79f9106e7cce2d681e763b9d38e60b44618ebc92460227835
-
SHA512
1fca2a4485cb0a491db34a282da400678822953d9b493203695df8afd12b02ef21ea6d472206032535bd849fb0bcd5f01163074332e893774e1ba23d4f06994f
-
SSDEEP
6144:G63iV0S70O5DNJaUpziQroDa0ajNj9V1+V1yF4dWb44CTwuJIqg64Zyj0r6:erh5VhKujNj9VUkHUV8uiq4Aw6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ffe6fb409cebf30fb7cc668aec3d2a8_JaffaCakes118
Files
-
3ffe6fb409cebf30fb7cc668aec3d2a8_JaffaCakes118.exe windows:5 windows x86 arch:x86
e6c74d4f15238ab6965db6cce5fb1440
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
olecli32
OleSetColorScheme
OleSaveToStream
ErrReconnect
GenCopy
WEP
LeReconnect
PbEnumFormats
OleGetLinkUpdateOptions
OleEnumFormats
LeChangeData
OleSetTargetDevice
CheckNetDrive
OleObjectConvert
GenEnumFormat
LeCopyFromLink
MfCopy
DefCreateFromTemplate
PbCreateLinkFromClip
BmEqual
DibGetData
OleLockServer
PbCreate
OleRevokeClientDoc
PbCreateFromClip
SrvrWndProc
BmChangeData
DefCreateLinkFromClip
OleQueryLinkFromClip
OleQueryReleaseError
ErrSetTargetDevice
OleQueryProtocol
LeClone
ErrUpdate
OleSetData
OleCreate
MfDraw
LeClose
kernel32
ResumeThread
GetFileInformationByHandle
GetComputerNameExA
LocalAlloc
HeapSize
OpenJobObjectA
FreeConsole
CreateSemaphoreA
CommConfigDialogW
LocalSize
QueryPerformanceCounter
GetTickCount
OutputDebugStringA
SetDefaultCommConfigW
FindFirstFileExA
ConvertFiberToThread
UnregisterWaitEx
SetNamedPipeHandleState
WriteConsoleInputA
GetProfileIntW
BaseUpdateAppcompatCache
VirtualAlloc
Module32First
CreateRemoteThread
SetConsoleKeyShortcuts
InterlockedPushEntrySList
GetProfileStringW
LZClose
EnumDateFormatsExW
GetCommProperties
DnsHostnameToComputerNameW
IsWow64Process
DosPathToSessionPathA
GetConsoleCP
GetCurrentThread
FindAtomW
LoadLibraryA
SetProcessPriorityBoost
SetComputerNameW
BuildCommDCBW
GetEnvironmentStringsW
user32
DdeKeepStringHandle
keybd_event
RealGetWindowClassW
LoadKeyboardLayoutW
LoadCursorFromFileA
GetAltTabInfoW
DrawTextExW
QuerySendMessage
ToUnicode
EndMenu
GetTabbedTextExtentA
SetScrollRange
DdeNameService
GetDesktopWindow
SetWindowLongW
EnumDisplaySettingsW
DdeClientTransaction
UserLpkTabbedTextOut
SetUserObjectInformationA
CharNextExA
PostMessageA
GetSystemMenu
SetRect
CreateCaret
IsIconic
CharNextA
DdeEnableCallback
TranslateMessage
GetWindow
DrawStateW
SetKeyboardState
CreateDesktopW
GetClipboardFormatNameW
SetSystemMenu
AllowForegroundActivation
SendMessageW
CallMsgFilterA
GetWindowTextW
GetMenuInfo
InSendMessageEx
GetClassNameA
MapVirtualKeyW
SetClipboardViewer
SetMessageExtraInfo
msvcirt
?hex@@YAAAVios@@AAV1@@Z
??_Giostream@@UAEPAXI@Z
?osfx@ostream@@QAEXXZ
?egptr@streambuf@@IBEPADXZ
??0fstream@@QAE@ABV0@@Z
??_Dstdiostream@@QAEXXZ
??0ostrstream@@QAE@XZ
?setlock@streambuf@@QAEXXZ
?x_statebuf@ios@@0PAJA
??_8iostream@@7Bistream@@@
??6ostream@@QAEAAV0@G@Z
?sync@filebuf@@UAEHXZ
??_Dfstream@@QAEXXZ
?delbuf@ios@@QAEXH@Z
??0strstream@@QAE@ABV0@@Z
??6ostream@@QAEAAV0@J@Z
?setf@ios@@QAEJJJ@Z
?bad@ios@@QBEHXZ
?open@filebuf@@QAEPAV1@PBDHH@Z
?floatfield@ios@@2JB
??0stdiobuf@@QAE@ABV0@@Z
??0ofstream@@QAE@ABV0@@Z
??0ostream@@IAE@ABV0@@Z
??4istream_withassign@@QAEAAVistream@@PAVstreambuf@@@Z
?sgetn@streambuf@@QAEHPADH@Z
??5istream@@QAEAAV0@AAN@Z
?setp@streambuf@@IAEXPAD0@Z
?doallocate@strstreambuf@@MAEHXZ
??1ifstream@@UAE@XZ
??0filebuf@@QAE@ABV0@@Z
??1istream_withassign@@UAE@XZ
?eof@ios@@QBEHXZ
??5istream@@QAEAAV0@PAC@Z
untfs
?TakeCensus@NTFS_SA@@QAEEPAVNTFS_MASTER_FILE_TABLE@@KPAUNTFS_CENSUS_INFO@@@Z
?QueryFileReference@NTFS_INDEX_TREE@@QAEEKPAXKPAU_MFT_SEGMENT_REFERENCE@@PAE@Z
??1NTFS_ATTRIBUTE_LIST@@UAE@XZ
??1NTFS_INDEX_TREE@@UAE@XZ
??0NTFS_BOOT_FILE@@QAE@XZ
?Write@NTFS_BITMAP@@QAEEPAVNTFS_ATTRIBUTE@@PAV1@@Z
?CompareFileName@NTFS_MFT_INFO@@SGEPAXKPAU_FILE_NAME@@PAG@Z
??0NTFS_MFT_FILE@@QAE@XZ
?GetNextAttributeRecord@NTFS_FRS_STRUCTURE@@QAEPAXPBXPAVMESSAGE@@PAE@Z
?SetVolumeFlag@NTFS_SA@@QAEEGPAE@Z
?MakeNonresident@NTFS_ATTRIBUTE@@UAEEPAVNTFS_BITMAP@@@Z
?AddFileNameAttribute@NTFS_FILE_RECORD_SEGMENT@@QAEEPAU_FILE_NAME@@@Z
?QueryAttribute@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_ATTRIBUTE@@PAEKPBVWSTRING@@@Z
Chkdsk
?InsertEntry@NTFS_INDEX_TREE@@QAEEKPAXU_MFT_SEGMENT_REFERENCE@@E@Z
?Initialize@NTFS_BITMAP_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
??1NTFS_FILE_RECORD_SEGMENT@@UAE@XZ
?Initialize@NTFS_BOOT_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
??1NTFS_SA@@UAE@XZ
?GetNext@NTFS_INDEX_TREE@@QAEPBU_INDEX_ENTRY@@PAKPAEE@Z
?AllocateFileRecordSegment@NTFS_MASTER_FILE_TABLE@@QAEEPAVBIG_INT@@E@Z
??0NTFS_BAD_CLUSTER_FILE@@QAE@XZ
Format
?Read@NTFS_SA@@QAEEPAVMESSAGE@@@Z
?ReadNext@NTFS_FRS_STRUCTURE@@QAEEVBIG_INT@@@Z
??0NTFS_BITMAP_FILE@@QAE@XZ
?QueryDefaultClustersPerIndexBuffer@NTFS_SA@@SGKPBVDP_DRIVE@@K@Z
?Save@NTFS_INDEX_TREE@@QAEEPAVNTFS_FILE_RECORD_SEGMENT@@@Z
?ReadList@NTFS_ATTRIBUTE_LIST@@QAEEXZ
??1NTFS_UPCASE_TABLE@@UAE@XZ
?Initialize@NTFS_ATTRIBUTE_RECORD@@QAEEPAVIO_DP_DRIVE@@PAX@Z
?IsAllocated@NTFS_BITMAP@@QBEEVBIG_INT@@0@Z
?Flush@NTFS_MFT_FILE@@QAEEXZ
?Initialize@NTFS_EXTENT_LIST@@QAEEVBIG_INT@@0@Z
??1NTFS_EXTENT_LIST@@UAE@XZ
??1NTFS_BITMAP_FILE@@UAE@XZ
??0NTFS_ATTRIBUTE_RECORD@@QAE@XZ
?CopyIterator@NTFS_INDEX_TREE@@QAEEPAV1@@Z
??0NTFS_REFLECTED_MASTER_FILE_TABLE@@QAE@XZ
?QueryExtentList@NTFS_ATTRIBUTE_RECORD@@QBEEPAVNTFS_EXTENT_LIST@@@Z
hhsetup
?Open@CCollection@@QAEKPBG@Z
?GetTitle@CLocation@@QAEPADXZ
?SetFirstChildFolder@CFolder@@QAEXPAV1@@Z
?DeleteFolder@CCollection@@QAEKPAVCFolder@@@Z
?AllocCopyValue@CCollection@@AAEKPAVCParseXML@@PADPAPAD@Z
??4CFolder@@QAEAAV0@ABV0@@Z
?GetLocation@CTitle@@QAEPAULocationHistory@@K@Z
?GetNextTitle@CTitle@@QAEPAV1@XZ
?GetTitleW@CLocation@@QAEPBGXZ
?MergeKeywords@CCollection@@QAEHPAD@Z
?SetExTitlePtr@CFolder@@QAEXPAVCExTitle@@@Z
?GetId@CTitle@@QAEPADXZ
?RemoveAll@CPointerList@@QAEXXZ
??4CLocation@@QAEAAV0@ABV0@@Z
?AddChildFolder@CFolder@@QAEKPAV1@@Z
?MergeKeywords@CCollection@@QAEHPAG@Z
?SetNextLocation@CLocation@@QAEXPAV1@@Z
?GetPathW@CLocation@@QAEPBGXZ
?AddLocationHistory@CTitle@@QAEKKPBG00PBVCLocation@@00H@Z
?GetTitle@CFolder@@QAEPADXZ
?AddLocationHistory@CTitle@@QAEKKPBD00PBVCLocation@@00H@Z
?Open@CCollection@@QAEKPBD@Z
?GetLanguage@CTitle@@QAEGXZ
?AddChildFolder@CFolder@@QAEPAV1@PBDKPAKG@Z
?DeleteChildren@CCollection@@AAEXPAPAVCFolder@@@Z
?AddRef@CCollection@@QAEXXZ
?AddLocation@CCollection@@QAEPAVCLocation@@PBD000PAK@Z
??4CPointerList@@QAEAAV0@ABV0@@Z
?GetIdW@CLocation@@QAEPBGXZ
crypt32
CertAddEncodedCertificateToSystemStoreA
CertSaveStore
CertGetNameStringW
I_CertSrvProtectFunction
CertVerifyCertificateChainPolicy
CertUnregisterSystemStore
CertOIDToAlgId
CertGetSubjectCertificateFromStore
CertCreateCTLEntryFromCertificateContextProperties
CryptSIPRemoveProvider
CryptQueryObject
CryptVerifyCertificateSignatureEx
I_CryptFindLruEntryData
CryptSignHashU
CryptHashToBeSigned
CertSetCertificateContextProperty
CryptVerifyMessageSignature
CertAddCertificateContextToStore
CertAddEncodedCTLToStore
CertRDNValueToStrW
CertAddCRLContextToStore
CertVerifyTimeValidity
CertGetEnhancedKeyUsage
CryptMsgDuplicate
CryptAcquireContextU
CertDeleteCertificateFromStore
CertCompareIntegerBlob
Sections
.text Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 531KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ