Static task
static1
Behavioral task
behavioral1
Sample
72dfb9d2af570cc966ab84be47e9f4e8_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
72dfb9d2af570cc966ab84be47e9f4e8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
72dfb9d2af570cc966ab84be47e9f4e8_JaffaCakes118
-
Size
129KB
-
MD5
72dfb9d2af570cc966ab84be47e9f4e8
-
SHA1
df55c61189210a6e8a0b1421449eebb3490f8aeb
-
SHA256
e4201e55b39c1acd62bc31f14d41ba5991be015b0709a416510001b7fd4b452d
-
SHA512
95b12d801cfd628b31fd0035b6d62c81a4261122a2c49acf37ef04281fbbc3e491b0ed38878d57ec6d5fdd9608494bfa8da6a9943d4c72452706f7cc63093fa7
-
SSDEEP
3072:SJjBXpgSQscRb59p455xEVK5vPaV4q+lajcR1QGr:STpoFgHzizaxr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 72dfb9d2af570cc966ab84be47e9f4e8_JaffaCakes118
Files
-
72dfb9d2af570cc966ab84be47e9f4e8_JaffaCakes118.exe windows:5 windows x86 arch:x86
44b573c19e23665397971a5e0af76034
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msdart
??1CCritSec@@QAE@XZ
?IsUnlocked@CLockedDoubleList@@QBE_NXZ
MpHeapReAlloc
?MpHeapCompact@@YAKPAX@Z
?ReadUnlock@CSpinLock@@QAEXXZ
?SetDefaultSpinAdjustmentFactor@CReaderWriterLock2@@SGXN@Z
?WriteLock@CLKRHashTable@@QAEXXZ
?TryWriteLock@CReaderWriterLock@@QAE_NXZ
??4CLKRHashTableStats@@QAEAAV0@ABV0@@Z
?_EqualKeys@CLKRLinearHashTable@@ABE_NKK@Z
?IsWriteUnlocked@CCritSec@@QBE_NXZ
MpHeapFree
?_DeleteKey@CLKRLinearHashTable@@AAE?AW4LK_RETCODE@@KK@Z
??1CLockedSingleList@@QAE@XZ
?DeleteRecord@CLKRLinearHashTable@@QAE?AW4LK_RETCODE@@PBX@Z
?Push@CLockedSingleList@@QAEXQAVCSingleListEntry@@@Z
?ConvertExclusiveToShared@CLKRHashTable@@QBEXXZ
?GetSpinCount@CSmallSpinLock@@QBEGXZ
??0CDoubleList@@QAE@XZ
??1CLockedDoubleList@@QAE@XZ
??0CLKRHashTableStats@@QAE@XZ
?ReadOrWriteLock@CReaderWriterLock3@@QAE_NXZ
?_Unlock@CSpinLock@@AAEXXZ
?ApplyIf@CLKRHashTable@@QAEKP6G?AW4LK_PREDICATE@@PBXPAX@ZP6G?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?RemoveTail@CDoubleList@@QAEQAVCListEntry@@XZ
?SetDefaultSpinAdjustmentFactor@CCritSec@@SGXN@Z
?_SegIndex@CLKRLinearHashTable@@ABEKK@Z
?IsReadUnlocked@CLKRLinearHashTable@@QBE_NXZ
?ReadUnlock@CLKRLinearHashTable@@QBEXXZ
?GetDefaultSpinCount@CCritSec@@SGGXZ
??1CReaderWriterLock2@@QAE@XZ
?_TryReadLock@CReaderWriterLock@@AAE_NXZ
?ReadOrWriteUnlock@CCritSec@@QAEX_N@Z
?TryWriteLock@CReaderWriterLock2@@QAE_NXZ
?TryReadLock@CSmallSpinLock@@QAE_NXZ
?GetSpinCount@CSpinLock@@QBEGXZ
?Unlock@CLockedDoubleList@@QAEXXZ
?WriteUnlock@CFakeLock@@QAEXXZ
?GetDefaultSpinAdjustmentFactor@CFakeLock@@SGNXZ
?IsWriteUnlocked@CReaderWriterLock3@@QBE_NXZ
??4CSpinLock@@QAEAAV0@ABV0@@Z
?WriteUnlock@CSmallSpinLock@@QAEXXZ
?IsUsable@CLKRLinearHashTable@@QBE_NXZ
?IsReadLocked@CLKRHashTable@@QBE_NXZ
?ConvertExclusiveToShared@CReaderWriterLock2@@QAEXXZ
?IsWriteLocked@CSmallSpinLock@@QBE_NXZ
?sm_wDefaultSpinCount@CCritSec@@1GA
?GetDefaultSpinCount@CReaderWriterLock3@@SGGXZ
?IsWin98orLater@CMdVersionInfo@@SAHXZ
?TryReadLock@CReaderWriterLock3@@QAE_NXZ
?ReadUnlock@CReaderWriterLock3@@QAEXXZ
?MaxSize@CLKRHashTable@@QBEKXZ
MPInitializeCriticalSection
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SGNXZ
?_ExtractKey@CLKRLinearHashTable@@ABE?BKPBX@Z
?_AddRefRecord@CLKRLinearHashTable@@ABEXPBXH@Z
?BucketIndex@CLKRHashTableStats@@SGJJ@Z
?sm_lpOSVERSIONINFO@CMdVersionInfo@@0PAU_OSVERSIONINFOW@@A
?_TryWriteLock2@CReaderWriterLock3@@AAE_NXZ
?GetSpinCount@CCritSec@@QBEGXZ
??4CLockedSingleList@@QAEAAV0@ABV0@@Z
?ConvertSharedToExclusive@CSmallSpinLock@@QAEXXZ
?IsEmpty@CSingleList@@QBE_NXZ
?sm_llGlobalList@CLKRLinearHashTable@@0VCLockedDoubleList@@A
?IsUsable@CLKRHashTable@@QBE_NXZ
?IsReadLocked@CCritSec@@QBE_NXZ
?ReadOrWriteLock@CSpinLock@@QAE_NXZ
?_DeleteIf@CLKRLinearHashTable@@AAEKP6G?AW4LK_PREDICATE@@PBXPAX@Z1AAW42@@Z
?GetDefaultSpinCount@CSmallSpinLock@@SGGXZ
?FindKey@CLKRHashTable@@QBE?AW4LK_RETCODE@@KPAPBX@Z
mtxoci
odessp
oexec
obreak
MTxOciInit
odescr
oexfet
odefin
MTxolog
oopen
oexn
Enlist
GetXaSwitch
olog
MTxOciGetVersion
oopt
ocon
orol
obindps
oclose
ocom
obndrv
ologTransacted
MTxOciRegisterCursor
ofen
ofetch
obndrn
ogetpi
DllRegisterServer
obndra
oermsg
oparse
DllUnregisterServer
ocan
opinit
odefinps
oflng
ologof
oerhms
ocof
osetpi
userenv
DeleteProfileA
FreeGPOListA
DllGetClassObject
LoadUserProfileA
GetUserProfileDirectoryA
RsopFileAccessCheck
GetAppliedGPOListW
RsopLoggingEnabled
RsopSetPolicySettingStatus
GetAllUsersProfileDirectoryA
GetPreviousFgPolicyRefreshInfo
GetAllUsersProfileDirectoryW
ProcessGroupPolicyCompleted
GetProfilesDirectoryA
DestroyEnvironmentBlock
ForceSyncFgPolicy
GetProfileType
RefreshPolicy
WaitForUserPolicyForegroundProcessing
ExpandEnvironmentStringsForUserA
LoadUserProfileW
GetUserProfileDirectoryW
GetDefaultUserProfileDirectoryA
UnregisterGPNotification
DeleteProfileW
GetGPOListA
RsopResetPolicySettingStatus
GetAppliedGPOListA
RegisterGPNotification
GetDefaultUserProfileDirectoryW
GetProfilesDirectoryW
CreateEnvironmentBlock
DllRegisterServer
LeaveCriticalPolicySection
ExpandEnvironmentStringsForUserW
EnterCriticalPolicySection
RefreshPolicyEx
DllUnregisterServer
UnloadUserProfile
GetGPOListW
GetNextFgPolicyRefreshInfo
ProcessGroupPolicyCompletedEx
RsopAccessCheckByType
WaitForMachinePolicyForegroundProcessing
msi
MsiReinstallProductW
MsiSetExternalUIW
MsiFormatRecordA
MsiGetFeatureCostW
MsiOpenDatabaseA
MsiDatabaseOpenViewW
MsiInstallMissingComponentW
MsiPreviewBillboardW
MsiOpenProductW
MsiDatabaseGetPrimaryKeysA
MsiGetShortcutTargetA
MsiAdvertiseScriptA
MsiRecordSetStringW
MsiViewGetColumnInfo
MsiDatabaseExportW
MsiProvideQualifiedComponentExW
MsiGetProductCodeA
MsiDatabaseIsTablePersistentW
MsiGetProductInfoA
MsiDeleteUserDataA
MsiGetProductInfoFromScriptA
MsiEnumComponentCostsA
MsiRecordSetStreamW
MsiSetMode
MsiRecordGetFieldCount
MsiIsProductElevatedA
MsiGetSummaryInformationW
MsiProvideComponentFromDescriptorA
MsiQueryProductStateA
MsiSummaryInfoSetPropertyW
MsiConfigureProductExA
MsiGetSourcePathA
MsiGetLastErrorRecord
MsiRecordIsNull
MsiRecordClearData
MsiGetDatabaseState
MsiProvideQualifiedComponentA
MsiEnumFeaturesA
MsiApplyPatchW
MsiSummaryInfoPersist
MsiProvideQualifiedComponentW
kernel32
GlobalLock
GetCPInfoExW
GetConsoleFontInfo
CreateThread
VirtualAlloc
GetPrivateProfileSectionW
CreateEventW
FindVolumeMountPointClose
GetProcessVersion
CreateFileW
BackupRead
GetFileAttributesW
GlobalAddAtomW
GlobalCompact
LocalHandle
SetMailslotInfo
SetProcessPriorityBoost
TlsGetValue
GetSystemTimeAsFileTime
SetConsoleOS2OemFormat
SizeofResource
GetFirmwareEnvironmentVariableA
SetFileAttributesW
ClearCommBreak
GlobalGetAtomNameA
UnregisterWaitEx
SetFirmwareEnvironmentVariableW
LZInit
GetProfileStringW
FoldStringA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
QueryDosDeviceA
GetConsoleTitleW
GetNumberFormatW
LCMapStringW
GetEnvironmentVariableA
FindFirstVolumeMountPointA
LoadLibraryA
PrivMoveFileIdentityW
BeginUpdateResourceA
GetDriveTypeW
setupapi
CM_Get_Resource_Conflict_DetailsW
CM_Get_Device_IDW
CM_Enumerate_Enumerators_ExA
pSetupAccessRunOnceNodeList
CM_Get_Device_Interface_List_SizeW
CM_Register_Device_Driver_Ex
pSetupStringTableInitializeEx
CM_Query_And_Remove_SubTree_ExW
SetupQueueRenameSectionW
CM_Free_Log_Conf
SetupDiGetClassRegistryPropertyA
SetupDiUnremoveDevice
CM_Locate_DevNode_ExA
SetupDiGetClassDevsExW
pSetupStringTableSetExtraData
CM_Uninstall_DevNode_Ex
CM_Request_Eject_PC_Ex
CM_Get_Class_Key_NameW
SetupPromptForDiskA
SetupAddSectionToDiskSpaceListW
SetupQueueCopyIndirectW
InstallHinfSection
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Custom_PropertyA
SetupCommitFileQueue
SetupDiGetClassDescriptionW
CM_Add_Range
CM_Get_Device_Interface_Alias_ExA
SetupDiGetClassDevPropertySheetsA
Sections
.text Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ