Static task
static1
Behavioral task
behavioral1
Sample
71a65de7135bd3eb2cd008f073742b3e_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
71a65de7135bd3eb2cd008f073742b3e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
71a65de7135bd3eb2cd008f073742b3e_JaffaCakes118
-
Size
166KB
-
MD5
71a65de7135bd3eb2cd008f073742b3e
-
SHA1
493b98aae0270130c2e668d43033fea13da8a4cb
-
SHA256
e5fcc53801318bfd7cbd6e224c902a81ae223889d6e6602dc6b534fceaa1ffcf
-
SHA512
c69b8e501c810f660e35c4de9380d0ae75064dd140219067e2742134af29e79c998decae29d1d530fb0e70bffa435e4015a6f973caaacb493f90572dbc64d2fa
-
SSDEEP
3072:FfVxwl8eEsgg0/n3hoTnoUbFMwPyqu92AjtUl3sXtYmhjVc2qhpV/rU5b:tggECSFiqI24ksXtJajptId
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 71a65de7135bd3eb2cd008f073742b3e_JaffaCakes118
Files
-
71a65de7135bd3eb2cd008f073742b3e_JaffaCakes118.exe windows:5 windows x86 arch:x86
0cbc4d2f28e2cfb230623155f2d84a29
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
query
?SetSZParam@CMachineAdmin@@QAEXPBG0K@Z
?_FindOrAddAnchor@CDbProjectNode@@AAEPAVCDbProjectListAnchor@@XZ
?GetGlobalStaticPropertyList@@YGPAVCStaticPropertyList@@XZ
?ParseQueryPhrase@CQueryParser@@QAEPAVCDbRestriction@@XZ
?DoIt@CCopyRcovObject@@QAEJXZ
??0CPersDeComp@@QAE@AAVPDirectory@@KAAVCPhysIndex@@KHH@Z
CIState
?IsCIDialect@CDbPropertyRestriction@@QAEHXZ
?PidToRealPid@CPidMapper@@QAEKK@Z
BindIFilterFromStream
??1CSynRestriction@@QAE@XZ
??0CPropertyStoreWids@@QAE@AAVCPropStoreManager@@@Z
??0CAllocStorageVariant@@QAE@W4VARENUM@@KAAVPMemoryAllocator@@@Z
??1CPropertyStoreWids@@QAE@XZ
??1CDbProp@@QAE@XZ
?AddRef@CQueryUnknown@@UAGKXZ
?Init@CRcovStorageHdr@@QAEXK@Z
?VT_VARIANT_LE@@YGHABUtagPROPVARIANT@@0@Z
?AddArg@CFwEventItem@@QAEXK@Z
?MultiByteToXArrayWideChar@@YGKPBEKIAAV?$XArray@G@@@Z
?GetTotalSizeInKB@CPropStoreManager@@QAEKXZ
?SetCY@CStorageVariant@@QAEXTtagCY@@I@Z
??0CPropertyRestriction@@QAE@KABVCFullPropSpec@@ABVCStorageVariant@@@Z
?Commit@CRcovStrmMDTrans@@QAEXXZ
?IsScopeValid@@YGJPBGIH@Z
?GetCGIVariableW@CWebServer@@QAEHPBGAAV?$XArray@G@@AAK@Z
?Accept@CQueryScanner@@QAEXXZ
?NextWorkId@CPropertyStoreWids@@QAEKXZ
?NumberOfSortProps@CCatState@@QBEIXZ
?CoTaskAllocator@@3VCCoTaskAllocator@@A
?Disconnect@CRequestClient@@QAEXXZ
?SetProperty@CDbPropBaseRestriction@@QAEHABUtagDBID@@@Z
?ciNew@@YGPAXI@Z
??1CDbPropBaseRestriction@@QAE@XZ
??1CMachineAdmin@@QAE@XZ
?GetR8@CAllocStorageVariant@@QBENI@Z
??0CDbNatLangRestriction@@QAE@PBGABVCDbColumnNode@@K@Z
??1CDbContentBaseRestriction@@QAE@XZ
??0CWorkQueue@@QAE@IW4WorkQueueType@0@@Z
?GetDrive@CDriveInfo@@SGXPBGPAG@Z
?GetPropType@CEmptyPropertyList@@SGGI@Z
?InitIterator@CPropertyList@@UAEXXZ
?Release@CEnumWorkid@@UAGKXZ
??0CDbColumnNode@@QAE@ABUtagDBID@@H@Z
?ciDelete@@YGXPAX@Z
?GetOleDBErrorInfo@@YGJPAUIUnknown@@ABU_GUID@@KIPAUtagERRORINFO@@PAPAUIErrorInfo@@@Z
LocateCatalogsW
CITextToFullTree
?GetString@CMemDeSerStream@@UAEPADXZ
?Marshall@CNodeRestriction@@QBEXAAVPSerStream@@@Z
?IsCIStarted@CMachineAdmin@@QAEHXZ
?My_wcstoui64@@YA_KPBGPAPAGH@Z
??0CFullPropSpec@@QAE@ABV0@@Z
?Marshall@CDbPropSet@@QBEXAAVPSerStream@@@Z
?GetCGIVariable@CWebServer@@QAEHPBDAAV?$XArray@G@@AAK@Z
??0CPropStoreManager@@QAE@K@Z
?Copy@CDbProp@@QAEHABUtagDBPROP@@@Z
?ciIsValidPointer@@YGHPBX@Z
?ReleaseWorkThreads@CWorkQueue@@QAEXXZ
??1CPropStoreManager@@QAE@XZ
?AcceptWord@CQueryScanner@@QAEXXZ
?SetI8@CStorageVariant@@QAEXT_LARGE_INTEGER@@I@Z
?SetUI8@CStorageVariant@@QAEXT_ULARGE_INTEGER@@I@Z
??0CWin32RegAccess@@QAE@PAUHKEY__@@PBG@Z
?Load@CLocalGlobalPropertyList@@QAEXQBG@Z
?Init@CPidLookupTable@@QAEHPAVPRcovStorageObj@@@Z
?ShrinkToFit@CPhysStorage@@QAEXXZ
?IsLeaf@CRestriction@@QBEHXZ
?GetByte@CMemDeSerStream@@UAEEXZ
?Get@CRegAccess@@QAEKPBG@Z
??0CNatLanguageRestriction@@QAE@PBGABVCFullPropSpec@@K@Z
??0CCategorizationSet@@QAE@ABV0@@Z
?IsStopped@CCatalogAdmin@@QAEHXZ
??0CFileBuffer@@QAE@AAVCFileMapView@@I@Z
??0CCiRegParams@@QAE@PBG@Z
??1CCatalogEnum@@QAE@XZ
?UnMarshall@CDbProp@@QAEHAAVPDeSerStream@@@Z
?LookupSDID@CSdidLookupTable@@QAEKPAXK@Z
??0CFwAsyncWorkItem@@QAE@AAVCWorkManager@@AAVCWorkQueue@@@Z
?SetDWORDParam@CMachineAdmin@@QAEXPBGK@Z
?Clone@CNodeRestriction@@QBEPAV1@XZ
?Resume@CProcess@@QAEXXZ
?UnMarshall@CDbPropSet@@QAEHAAVPDeSerStream@@@Z
CiSvcMain
?UnMarshallTree@CDbCmdTreeNode@@SGPAV1@AAVPDeSerStream@@@Z
?Append@CEnumWorkid@@QAEXK@Z
?Get@CWin32RegAccess@@QAEHPBGAAK@Z
?GetSortProp@CCatState@@QBEXIPAPBGPAW4SORTDIR@@@Z
?SetBSTR@CAllocStorageVariant@@QAEXPAGAAVPMemoryAllocator@@@Z
kernel32
EscapeCommFunction
GetNamedPipeInfo
SetEnvironmentVariableW
IsDebuggerPresent
GetGeoInfoA
CreateFileW
MapViewOfFile
LZCloseFile
WritePrivateProfileSectionA
LocalFileTimeToFileTime
SetConsolePalette
GetComPlusPackageInstallStatus
IsValidLocale
ProcessIdToSessionId
VirtualAlloc
InitializeSListHead
EnumResourceTypesW
GetSystemDefaultLCID
SetProcessShutdownParameters
ReadFile
GetUserDefaultLCID
WaitForMultipleObjects
LeaveCriticalSection
LoadLibraryA
RtlCaptureContext
LoadLibraryExW
GetThreadLocale
GetHandleContext
_hwrite
IsValidCodePage
EnumUILanguagesW
FindNextFileA
EnterCriticalSection
GetConsoleInputExeNameA
QueryPerformanceCounter
GlobalLock
SetFileValidData
WaitForDebugEvent
GetCurrencyFormatA
InvalidateConsoleDIBits
DeleteCriticalSection
GetVolumeNameForVolumeMountPointA
crypt32
CertResyncCertificateChainEngine
I_CertSrvProtectFunction
CertVerifyValidityNesting
CryptMsgOpenToDecode
CertStrToNameA
CryptGetOIDFunctionValue
I_CryptDetachTls
I_CryptRegisterSmartCardStore
CryptImportPublicKeyInfo
I_CryptFindSmartCardCertInStore
CryptSIPAddProvider
CryptSIPGetSignedDataMsg
CryptVerifyCertificateSignatureEx
CertVerifyRevocation
CryptMsgGetParam
CryptVerifyMessageHash
CryptDecryptMessage
CertEnumCTLContextProperties
PFXExportCertStore
CryptGetDefaultOIDFunctionAddress
CertCreateCertificateChainEngine
CryptEnumKeyIdentifierProperties
CryptSIPRemoveSignedDataMsg
CryptInitOIDFunctionSet
CertGetPublicKeyLength
CryptMemRealloc
CertUnregisterSystemStore
CertEnumCertificatesInStore
CryptDecodeObjectEx
CertOpenStore
CryptGetMessageSignerCount
CryptMsgClose
CryptDecodeMessage
RegCreateKeyExU
iphlpapi
NhGetGuidFromInterfaceName
SetAdapterIpAddress
GetIpStatisticsEx
GetIpAddrTable
GetIpErrorString
_PfAddGlobalFilterToInterface@8
GetNumberOfInterfaces
_PfGetInterfaceStatistics@16
GetTcpStatistics
AddIPAddress
InternalDeleteIpNetEntry
GetIfTable
RestoreMediaSense
GetIcmpStatistics
DeleteIPAddress
register_icmp
GetBestInterface
FlushIpNetTable
GetRTTAndHopCount
IcmpSendEcho2
_PfRemoveGlobalFilterFromInterface@8
_PfSetLogBuffer@28
_PfRemoveFiltersFromInterface@20
GetFriendlyIfIndex
GetTcpTable
CreateProxyArpEntry
IpRenewAddress
_PfBindInterfaceToIPAddress@12
_PfUnBindInterface@4
do_echo_rep
GetUdpStatisticsEx
InternalCreateIpForwardEntry
InternalGetIpAddrTable
IcmpCloseHandle
EnableRouter
GetUniDirectionalAdapterInfo
SetIpNetEntry
NhGetInterfaceNameFromGuid
IpReleaseAddress
GetAdaptersAddresses
SetIpTTL
gdi32
CopyMetaFileW
FONTOBJ_pxoGetXform
FONTOBJ_pvTrueTypeFontFile
EnumICMProfilesW
DdEntry16
DdEntry51
DdEntry52
NamedEscape
STROBJ_vEnumStart
SetBitmapAttributes
GetNearestPaletteIndex
ColorCorrectPalette
ExtEscape
DdEntry24
CombineRgn
PolyTextOutW
EngBitBlt
DdEntry22
RestoreDC
CreateBrushIndirect
EnumFontsW
bInitSystemAndFontsDirectoriesW
GetCharABCWidthsFloatA
EngDeletePath
Pie
DdEntry2
GdiQueryFonts
DdEntry26
GetTextMetricsA
GdiEntry11
SetPaletteEntries
GdiEntry13
GetEnhMetaFileA
SetDeviceGammaRamp
SetViewportExtEx
FONTOBJ_pifi
EngFillPath
GetTextExtentPoint32W
DdEntry23
HT_Get8BPPMaskPalette
GetMapMode
DdEntry55
GdiTransparentBlt
GdiEntry9
advapi32
CloseEncryptedFileRaw
LogonUserExA
ObjectDeleteAuditAlarmA
CryptEnumProvidersA
RegQueryValueExA
ChangeServiceConfig2W
LookupPrivilegeValueW
RegQueryValueW
LsaICLookupSids
SystemFunction029
WmiDevInstToInstanceNameA
AddAuditAccessAce
ElfCloseEventLog
OpenThreadToken
ConvertStringSDToSDDomainW
LsaSetTrustedDomainInformation
BuildTrusteeWithNameA
CredReadW
BuildTrusteeWithSidW
CredRenameA
GetAce
GetInformationCodeAuthzLevelW
CreateCodeAuthzLevel
RegEnumKeyExW
WmiNotificationRegistrationW
DuplicateToken
BuildTrusteeWithObjectsAndNameW
lz32
LZRead
LZClose
GetExpandedNameA
CopyLZFile
LZInit
LZCopy
LZSeek
LZCloseFile
LZOpenFileA
LZStart
LZOpenFileW
LZDone
Sections
.text Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ