Static task
static1
Behavioral task
behavioral1
Sample
77ff5e2b2573a36f32700d022efabc22_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
77ff5e2b2573a36f32700d022efabc22_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
77ff5e2b2573a36f32700d022efabc22_JaffaCakes118
-
Size
102KB
-
MD5
77ff5e2b2573a36f32700d022efabc22
-
SHA1
58a2250e3fb3d2e1d1d10c61eaa1fc9ae7537c16
-
SHA256
100f17e943ce69319b73bded68e87602cd458dc6dd72b888c35ea18a4130fb70
-
SHA512
d897a1e67de9332856481fbde5ddaf26a7bfc2ce2a7d3f269852bfb6d0b557a607ca90d0730531e73c765e705894daa299039efc23b25d4f8807f782e2a13c4d
-
SSDEEP
3072:D3bKEdYaSt7qb1vn+66AA5Aek5Mq25tD69OZ:DLaxrk5ML514S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 77ff5e2b2573a36f32700d022efabc22_JaffaCakes118
Files
-
77ff5e2b2573a36f32700d022efabc22_JaffaCakes118.exe windows:1 windows x86 arch:x86
5bd4799b5867c470d2b7913b5b0f7c10
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
ChangeServiceConfigA
MSChapSrvChangePassword2
DeleteAce
ElfClearEventLogFileA
IsTextUnicode
WmiQueryAllDataMultipleW
GetInformationCodeAuthzPolicyW
QueryServiceObjectSecurity
LsaLookupPrivilegeName
LsaNtStatusToWinError
ElfOpenBackupEventLogW
CredEnumerateW
CredWriteDomainCredentialsW
AddAuditAccessAce
SystemFunction014
CryptDecrypt
ImpersonateSelf
AreAllAccessesGranted
ConvertSecurityDescriptorToStringSecurityDescriptorA
SaferGetPolicyInformation
LsaQueryInfoTrustedDomain
GetEffectiveRightsFromAclA
GetMultipleTrusteeW
CryptSignHashA
BuildTrusteeWithSidW
CredWriteW
SetAclInformation
GetServiceDisplayNameA
RegSetValueW
RegQueryMultipleValuesA
BuildImpersonateTrusteeW
ElfBackupEventLogFileW
RegSaveKeyExW
vssapi
?IsPartialFileSupportEnabled@CVssWriter@@IBG_NXZ
?Unsubscribe@CVssWriter@@QAGJXZ
?GetCurrentLevel@CVssWriter@@IBG?AW4_VSS_APPLICATION_LEVEL@@XZ
?OnBackupCompleteEnd@CVssJetWriter@@UAG_NPAVIVssWriterComponents@@_N@Z
?CreateVssExamineWriterMetadata@@YGJPAGPAPAVIVssExamineWriterMetadata@@@Z
?OnThawEnd@CVssJetWriter@@UAG_N_N@Z
VssFreeSnapshotProperties
?CreateVssBackupComponents@@YGJPAPAVIVssBackupComponents@@@Z
??1CVssWriter@@UAE@XZ
?OnPreRestoreBegin@CVssJetWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnPostRestoreEnd@CVssJetWriter@@UAG_NPAVIVssWriterComponents@@_N@Z
?Uninitialize@CVssJetWriter@@QAGXXZ
?OnPrepareSnapshotEnd@CVssJetWriter@@UAG_N_N@Z
?OnAbortBegin@CVssJetWriter@@UAGXXZ
?OnPostRestore@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnPostSnapshot@CVssJetWriter@@UAG_NPAVIVssWriterComponents@@@Z
??0CVssWriter@@QAE@XZ
?IsPathAffected@CVssWriter@@IBG_NPBG@Z
?OnBackOffIOOnVolume@CVssWriter@@UAG_NPAGU_GUID@@1@Z
?OnVSSApplicationStartup@CVssWriter@@UAG_NXZ
?OnPostRestoreBegin@CVssJetWriter@@UAG_NPAVIVssWriterComponents@@@Z
??0CVssJetWriter@@QAE@XZ
?OnBackupCompleteBegin@CVssJetWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnPrepareBackupBegin@CVssJetWriter@@UAG_NPAVIVssWriterComponents@@@Z
?Subscribe@CVssWriter@@QAGJK@Z
?OnVSSShutdown@CVssWriter@@UAG_NXZ
?OnFreezeEnd@CVssJetWriter@@UAG_N_N@Z
?IsBootableSystemStateBackedUp@CVssWriter@@IBG_NXZ
?OnContinueIOOnVolume@CVssWriter@@UAG_NPAGU_GUID@@1@Z
?OnFreezeBegin@CVssJetWriter@@UAG_NXZ
?OnPreRestoreEnd@CVssJetWriter@@UAG_NPAVIVssWriterComponents@@_N@Z
?CreateVssSnapshotSetDescription@@YGJU_GUID@@JPAPAVIVssSnapshotSetDescription@@@Z
?InstallAlternateWriter@CVssWriter@@QAGJU_GUID@@0@Z
?OnBackupComplete@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?GetCurrentVolumeArray@CVssWriter@@IBGPAPBGXZ
?OnIdentify@CVssJetWriter@@UAG_NPAVIVssCreateWriterMetadata@@@Z
?SetWriterFailure@CVssWriter@@IAGJJ@Z
??1CVssJetWriter@@UAE@XZ
?OnAbortEnd@CVssJetWriter@@UAGXXZ
?OnPrepareBackup@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?GetCurrentVolumeCount@CVssWriter@@IBGIXZ
IsVolumeSnapshotted
?OnPostSnapshot@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
shlwapi
PathMatchSpecA
SHRegOpenUSKeyW
PathMakePrettyA
PathRenameExtensionA
DllGetVersion
ChrCmpIW
StrRStrIW
SHOpenRegStreamW
UrlEscapeA
SHRegWriteUSValueW
PathIsURLW
PathUnmakeSystemFolderW
PathCompactPathA
PathIsPrefixW
PathRelativePathToA
SHOpenRegStreamA
SHRegDeleteUSValueA
PathIsLFNFileSpecA
SHQueryValueExA
PathRemoveBlanksW
PathUnquoteSpacesA
DelayLoadFailureHook
StrToIntExW
StrChrIW
SHQueryValueExW
PathFindNextComponentA
PathIsNetworkPathW
SHRegGetBoolUSValueW
StrCatBuffW
StrStrNW
ColorHLSToRGB
PathRemoveBlanksA
ColorAdjustLuma
SHDeleteEmptyKeyW
UrlIsNoHistoryW
SHRegSetPathW
user32
RegisterClassA
PostQuitMessage
DefWindowProcA
msvcrt
_wsetlocale
_cexit
wcstod
_inpw
abort
_CIlog10
putc
_mbsrchr
isprint
_CIpow
_chgsign
swscanf
_execve
_ismbcpunct
_mbsncmp
wcscspn
putchar
??_Gexception@@UAEPAXI@Z
_wctime
?unexpected@@YAXXZ
puts
rand
_wsystem
_aligned_offset_realloc
_close
_creat
_CIatan
??_Ebad_cast@@UAEPAXI@Z
getc
_get_osfhandle
_adj_fdiv_m16i
perror
ole32
CLIPFORMAT_UserUnmarshal
CoAllowSetForegroundWindow
CreateObjrefMoniker
StringFromCLSID
OleDuplicateData
STGMEDIUM_UserFree
CLSIDFromString
HBITMAP_UserSize
StgGetIFillLockBytesOnILockBytes
IsValidIid
CoIsHandlerConnected
CoRegisterChannelHook
CoGetMarshalSizeMax
OleNoteObjectVisible
OleCreateFromData
DoDragDrop
RegisterDragDrop
HICON_UserFree
CoMarshalHresult
HMETAFILEPICT_UserMarshal
CoReactivateObject
OleCreateLink
CoInitializeSecurity
OleDoAutoConvert
CoQueryProxyBlanket
HACCEL_UserUnmarshal
CoRegisterClassObject
kernel32
VirtualAlloc
ResetEvent
IsBadHugeReadPtr
OpenEventW
QueryPerformanceCounter
GetPrivateProfileIntA
EnumResourceLanguagesA
WriteProfileSectionA
CancelIo
GlobalFindAtomW
DeleteTimerQueueEx
LoadLibraryA
PrepareTape
HeapCreate
GlobalFindAtomA
ResumeThread
ExpungeConsoleCommandHistoryW
FindFirstFileExW
SetTimeZoneInformation
GetVolumeNameForVolumeMountPointW
OutputDebugStringW
EnumUILanguagesA
GetStartupInfoA
GetProcessShutdownParameters
ReadConsoleA
_lclose
BaseDumpAppcompatCache
UTUnRegister
CreateTapePartition
GetTapePosition
GetDefaultCommConfigA
FindActCtxSectionStringA
CloseHandle
LZOpenFileW
IsBadWritePtr
SetComputerNameW
comctl32
ImageList_SetFlags
PropertySheetW
DrawStatusTextW
_TrackMouseEvent
FlatSB_SetScrollPos
ImageList_DrawIndirect
ImageList_SetDragCursorImage
ImageList_SetOverlayImage
CreatePropertySheetPageA
ImageList_LoadImage
ImageList_SetBkColor
ImageList_Destroy
FlatSB_GetScrollProp
ImageList_DragLeave
CreateStatusWindowW
InitializeFlatSB
ImageList_Copy
FlatSB_ShowScrollBar
ImageList_DragEnter
ImageList_Write
ImageList_GetImageCount
ImageList_SetIconSize
ImageList_Remove
LBItemFromPt
ImageList_Add
Sections
.text Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ