Static task
static1
Behavioral task
behavioral1
Sample
821214eb76b329e48cf639d2e5f23a46_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
821214eb76b329e48cf639d2e5f23a46_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
821214eb76b329e48cf639d2e5f23a46_JaffaCakes118
-
Size
32KB
-
MD5
821214eb76b329e48cf639d2e5f23a46
-
SHA1
3895da2843438acf2034cce3331e71e9b660537a
-
SHA256
08c00b1867f0e0fbcf9ba169557c5e132ce40c70c2e4c5d55594e349206c032b
-
SHA512
71569c199306db04e3a0183da3ee79308acb89bc1259b8354b1a26d14919e58b4cc7c5d2bb40c871e5911e364de330041c0632ee78f7d52a05d53c2a2c167d00
-
SSDEEP
768:Bdr7aWxayb3lUD75xReabnkUIX0hWCpM9vQhgz:Tr7aRG3M5XeunkUIX0np6vQhm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 821214eb76b329e48cf639d2e5f23a46_JaffaCakes118
Files
-
821214eb76b329e48cf639d2e5f23a46_JaffaCakes118.exe windows:5 windows x86 arch:x86
7b60251dcaac8ab9381b1d7746580e2b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
FillRgn
CLIPOBJ_ppoGetPath
CreateRoundRectRgn
StretchDIBits
GetPaletteEntries
GetFontData
SetFontEnumeration
SetGraphicsMode
STROBJ_bGetAdvanceWidths
DdEntry37
EngFindResource
BRUSHOBJ_ulGetBrushColor
GetLayout
GetTextExtentPointW
CreateFontIndirectA
DdEntry11
GetRelAbs
EngStrokeAndFillPath
CreateICW
ScaleViewportExtEx
OffsetClipRgn
GetFontResourceInfoW
InvertRgn
EndPage
RectVisible
GdiEntry11
GetCharABCWidthsW
CreatePolyPolygonRgn
GetStringBitmapW
ExtTextOutA
GdiEntry2
EngQueryEMFInfo
GetTextExtentExPointW
EndDoc
DdEntry10
GdiCreateLocalEnhMetaFile
GetViewportOrgEx
EngAssociateSurface
GetGlyphOutlineWow
CreateColorSpaceA
GdiConvertToDevmodeW
kernel32
EnumCalendarInfoW
GetBinaryTypeW
ScrollConsoleScreenBufferA
OpenFileMappingW
SetCurrentDirectoryW
GetTempPathW
ShowConsoleCursor
FindFirstChangeNotificationW
SetThreadIdealProcessor
LZClose
GetProfileStringA
CreateFileA
OpenSemaphoreA
FindNextFileW
VirtualAlloc
CancelTimerQueueTimer
ResumeThread
GetConsoleKeyboardLayoutNameA
FindAtomA
HeapSetInformation
DefineDosDeviceA
GetStringTypeA
SetFileApisToOEM
SetSystemTime
OpenWaitableTimerW
DeleteTimerQueueTimer
IsBadHugeReadPtr
GetTapeParameters
SetThreadAffinityMask
GetVolumeInformationA
EnumSystemLocalesA
CreateSemaphoreW
ActivateActCtx
UnmapViewOfFile
HeapDestroy
BackupWrite
ExitVDM
HeapCreate
CancelDeviceWakeupRequest
CreateProcessA
lstrcatA
FindFirstFileExW
WriteProfileSectionA
TermsrvAppInstallMode
OpenProcess
GetNumberOfConsoleFonts
msvcrt40
??1strstream@@UAE@XZ
_putch
_mbsnbcnt
_lfind
memset
_wspawnlp
??5istream@@QAEAAV0@P6AAAV0@AAV0@@Z@Z
??5istream@@QAEAAV0@AAF@Z
_iob
??0__non_rtti_object@@QAE@ABV0@@Z
?_query_new_mode@@YAHXZ
_adjust_fdiv
_CIatan
iscntrl
__p__acmdln
_mbsncmp
tolower
??_E__non_rtti_object@@UAEPAXI@Z
__RTtypeid
??4iostream@@IAEAAV0@AAV0@@Z
_mbctombb
?raw_name@type_info@@QBEPBDXZ
?sh_none@filebuf@@2HB
dmdskmgr
?IsSecureSystemPartition@CTaskData@@QAEHXZ
?FindRegionPtrFromRegionId@CTaskData@@QAEH_JPAPAVCDMNodeObj@@@Z
?GetUnallocSpace@CDMNodeObj@@QAE_JH@Z
?IsCurrSystemVolume@CDMNodeObj@@QAEHXZ
?GetFileSystemName@CDMNodeObj@@QAEXAAVCString@@@Z
?IsHiddenRegion@CDMNodeObj@@QAEHXZ
?GetDiskSpec@CDMNodeObj@@QAEHAAUdiskspec@@@Z
?GetLogicalDriveCount@CDMNodeObj@@QAEKXZ
DllGetClassObject
?Command@CContextMenu@@QAEJJPAUIDataObject@@J@Z
?GetName@CDMNodeObj@@QAEXAAVCString@@@Z
?EnumVolumes@CTaskData@@QAEXAAKPAPAJ@Z
?ContainsSystemPartition@CDMNodeObj@@QAEHXZ
?IsMember@CDMNodeObj@@QAEHPAV1@@Z
?GetShortName@CDMNodeObj@@QAEXAAVCString@@@Z
?GetParentDiskPtr@CDMNodeObj@@QAEPAV1@XZ
?GetDiskCookies@CTaskData@@QAEXAAKPAPAJHKH@Z
?IsDiskEmpty@CDMNodeObj@@QAEHXZ
?IsActive@CDMNodeObj@@QAEHXZ
?EnumFirstVolumeMember@CDMNodeObj@@QAEXAAJ0@Z
?IsAlpha@CTaskData@@QAEHXZ
?GetImageNum@CDMNodeObj@@QAEHXZ
?IsNEC_98Server@CTaskData@@QAEHXZ
?GetRegionInfo@CDMNodeObj@@QAEHAAUregioninfoex@@@Z
?ContainsBootVolumesNumberChange@CDMNodeObj@@QAEH_JPAH@Z
?GetMaxAdjustedFreeSize@CDMNodeObj@@QAEXAA_J@Z
?IsUpgradeable@CDMNodeObj@@QAEHXZ
?GetDiskInfo@CDMNodeObj@@QAEHAAUdiskinfoex@@@Z
GetPropertyPageData
LoadPropertyPageData
?ContainsRealSystemPartition@CDMNodeObj@@QAEHXZ
?GetResultStringArray@CDMNodeObj@@QAEHAAVCStringArray@@@Z
?GetVolumeStatus@CDMNodeObj@@QAEHAAVCString@@@Z
?GetNumMembers@CDMNodeObj@@QAEKXZ
?FindFileSystem@CTaskData@@QAEH_JAAUfilesysteminfo@@@Z
?GetFileSystemLabel@CDMNodeObj@@QAEXAAVCString@@@Z
?IsCurrBootVolume@CDMNodeObj@@QAEHXZ
wsock32
GetTypeByNameW
getservbyport
shutdown
WSACancelAsyncRequest
recv
WSASetBlockingHook
WSACleanup
WSAAsyncGetProtoByNumber
gethostbyaddr
AcceptEx
rresvport
ntohs
send
socket
GetNameByTypeW
select
recvfrom
WSARecvEx
GetServiceW
ioctlsocket
WSAStartup
getprotobynumber
MigrateWinsockConfiguration
TransmitFile
WSAIsBlocking
GetAddressByNameA
msdmo
DMOEnum
DMOStrToGuidW
MoCopyMediaType
DMOStrToGuidA
DMOGuidToStrA
MoFreeMediaType
DMOGuidToStrW
DMORegister
DMOGetTypes
MoCreateMediaType
MoDuplicateMediaType
MoInitMediaType
DMOUnregister
MoDeleteMediaType
DMOGetName
rpcns4
RpcNsBindingUnexportW
RpcNsBindingExportPnPA
I_RpcNsSendReceive
I_RpcNsNegotiateTransferSyntax
RpcNsEntryExpandNameA
RpcNsMgmtBindingUnexportA
RpcNsBindingUnexportA
RpcNsBindingImportNext
I_RpcNsGetBuffer
RpcNsEntryObjectInqBeginW
I_RpcReBindBuffer
I_RpcNsRaiseException
RpcNsProfileEltInqDone
RpcIfIdVectorFree
RpcNsBindingExportA
RpcNsBindingLookupDone
RpcNsMgmtEntryCreateA
RpcNsMgmtBindingUnexportW
RpcNsBindingUnexportPnPA
RpcNsGroupMbrInqNextW
RpcNsProfileEltInqBeginA
RpcNsEntryObjectInqNext
RpcNsProfileEltRemoveW
RpcNsBindingImportBeginA
RpcNsMgmtEntryInqIfIdsA
RpcNsGroupMbrInqDone
RpcNsEntryExpandNameW
RpcNsBindingLookupBeginA
RpcNsBindingImportDone
RpcNsMgmtEntryCreateW
RpcNsBindingSelect
msvcrt20
??0istrstream@@QAE@ABV0@@Z
??0istream_withassign@@QAE@PAVstreambuf@@@Z
?sh_read@filebuf@@2HB
_ismbcpunct
?x_statebuf@ios@@0QAJA
_tcsnextc
?open@filebuf@@QAEPAV1@PBDHH@Z
sscanf
_wsystem
_wfindfirst
?cout@@3Vostream_withassign@@A
_wfopen
??6ostream@@QAEAAV0@P6AAAV0@AAV0@@Z@Z
_commode
?seekg@istream@@QAEAAV1@J@Z
__p__wcmdln
_tcsnbcnt
__argc
?get@istream@@QAEAAV1@AAVstreambuf@@D@Z
??5istream@@QAEAAV0@PAD@Z
_getche
_fileinfo
??0ifstream@@QAE@PBDHH@Z
??0ios@@IAE@XZ
??_7strstream@@6B@
_assert
printf
??_Distream@@QAEXXZ
_ismbbpunct
?xsputn@streambuf@@UAEHPBDH@Z
??_8istream@@7B@
putc
srand
?out_waiting@streambuf@@QBEHXZ
?overflow@strstreambuf@@UAEHH@Z
?iword@ios@@QBEAAJH@Z
wcstok
_jn
_getdrives
?setb@streambuf@@IAEXPAD0H@Z
?setbuf@filebuf@@UAEPAVstreambuf@@PADH@Z
?oct@@YAAAVios@@AAV1@@Z
_global_unwind2
??0ofstream@@QAE@HPADH@Z
_control87
?width@ios@@QAEHH@Z
?setp@streambuf@@IAEXPAD0@Z
_setmbcp
_stricoll
_isctype
sin
memcmp
wcsstr
strtod
??5istream@@QAEAAV0@AAD@Z
?lock@streambuf@@QAEXXZ
??_Gistream@@UAEPAXI@Z
exit
_mbsnbset
_wtol
isprint
_strset
_mbsinc
??4ostream_withassign@@QAEAAVostream@@ABV1@@Z
??_Dostream@@QAEXXZ
__p__environ
wctomb
rename
raise
_mbsspnp
_fmode
_onexit
crypt32
CryptRegisterDefaultOIDFunction
CryptHashCertificate
I_CryptAddSmartCardCertToStore
CryptSIPLoad
CryptSIPPutSignedDataMsg
CertFindRDNAttr
I_CryptRegisterSmartCardStore
CertDuplicateStore
CertAddCertificateContextToStore
CryptSIPRetrieveSubjectGuidForCatalogFile
CertCreateCTLContext
I_CryptInsertLruEntry
I_CryptSetTls
RegCreateKeyExU
CertEnumCRLContextProperties
CertEnumCRLsInStore
CertAddEncodedCRLToStore
CertEnumCertificatesInStore
CertSetCertificateContextProperty
CertAddCTLLinkToStore
CryptMsgGetAndVerifySigner
CertAlgIdToOID
I_CryptUninstallOssGlobal
CertGetPublicKeyLength
CertCompareCertificate
CertStrToNameW
CryptMsgUpdate
I_CertProtectFunction
CryptUnprotectData
I_CertSyncStore
CryptDecryptAndVerifyMessageSignature
CertCreateCertificateContext
CryptSignCertificate
CertFindCertificateInCRL
CryptSIPRemoveProvider
opengl32
glRasterPos3f
glMap2f
glVertex2s
glGetLightfv
glEvalCoord2f
glLineStipple
glPushName
glBitmap
wglCreateContext
glAlphaFunc
glLightfv
glGetTexGeniv
glStencilFunc
glDeleteLists
glShadeModel
glGetTexEnvfv
glVertex2i
glNormal3s
glDrawBuffer
glTexParameterf
glTexCoord4sv
glEdgeFlagv
glRotated
glMaterialfv
glGetTexParameteriv
glPointSize
glEvalCoord2d
glGenTextures
glGetTexGenfv
glCopyPixels
glVertex2sv
glColor3ub
glMapGrid2d
glTexCoord4fv
glTexCoord4s
glIndexPointer
glRasterPos3d
GlmfInitPlayback
glEvalPoint2
glTexCoord2s
glEdgeFlag
glCallLists
glClearStencil
glEvalCoord1d
glColor3d
sqlwoa
AllocConvertMultiSZNameToA
_SetProp@12
_CreateFontIndirect@4
_TextOut@20
_tsystem
_GetObject@12
newWideCharFromMultiByte
_GetDlgItemText@16
_GetSaveFileName@4
_GetTextExtentPoint32@16
_CreateWindowEx@48
_trename
_GetWindowTextLength@4
_ExtTextOut@32
_GetTextMetrics@8
_MessageBox@16
_CreateFile@28
_TranslateAccelerator@12
_WinHelp@16
_DrawText@20
_CharLower@4
_LoadBitmap@8
_IsDialogMessage@8
_SetWindowLong@12
_GetWindowLong@8
_LoadCursor@8
_GetUserName@8
newMultiByteFromWideCharSize
_GetDiskFreeSpaceEx@16
_FindResource@12
user32
SetScrollPos
IsIconic
MoveWindow
w32topl
ToplGraphCreate
ToplEdgeSetToVertex
ToplGraphAddVertex
ToplVertexCreate
ToplScheduleCreate
ToplVertexGetParent
ToplVertexGetInEdge
ToplAddEdgeSetToGraph
ToplSetAllocator
ToplPScheduleValid
ToplVertexNumberOfOutEdges
ToplEdgeInit
ToplListSetIter
ToplVertexFree
ToplGraphSetVertexIter
ToplListAddElem
ToplDeleteComponents
ToplSTHeapDestroy
ToplDeleteGraphState
ToplGraphMakeRing
ToplIterAdvance
ToplHeapCreate
ToplIterCreate
ToplVertexSetParent
ToplEdgeDestroy
ToplGraphRemoveVertex
ToplAddEdgeToGraph
ToplHeapExtractMin
ToplMakeGraphState
ToplFree
ToplVertexGetId
ToplHeapIsEmpty
ToplSTHeapCostReduced
ToplHeapInsert
ToplSTHeapInit
ToplListRemoveElem
ToplScheduleMerge
ToplEdgeCreate
ToplScheduleExportReadonly
ToplGraphNumberOfVertices
ToplScheduleMaxUnavailable
ToplVertexSetId
ToplSTHeapExtractMin
ToplGetAlwaysSchedule
ToplVertexInit
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 990B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ