Static task
static1
Behavioral task
behavioral1
Sample
mypic.scr
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
mypic.scr
Resource
win10v2004-20240802-en
General
-
Target
861c2efa6e7cc87f518b51898ecbbc79_JaffaCakes118
-
Size
370KB
-
MD5
861c2efa6e7cc87f518b51898ecbbc79
-
SHA1
dea4cfaf5f68b85c8a17a42281358d294a7dae38
-
SHA256
f76a13784e09792a4396487583c333e5d477aed49cc71d306ae26c50ebdfc672
-
SHA512
ec936e78d4215174048d4be66ecf7787c46878b03636cc820e24636f1a170dcc66b79726948fbd2a5f0f51a247e5d864c478f5052d511f92a1a7e2dc23e1a403
-
SSDEEP
6144:IGPD9MrYzEPImA8YHEtYUlypqFxT16dPqsFa2L9140eAQJEf5oJw0wOqRSp/5id8:dPD9MrnImA8YrUl7Lp6dXaw10JEh9tOd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/mypic.scr
Files
-
861c2efa6e7cc87f518b51898ecbbc79_JaffaCakes118.zip
-
mypic.scr.exe windows:5 windows x86 arch:x86
1bbffff9ed005892ac30148532a5f04d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
dnsapi
DnsUnicodeToUtf8
DnsGetDomainName
Dns_InitializeWinsock
DnsNotifyResolverEx
DnsIsAMailboxType
DnsNameCompareEx_UTF8
DnsGetLastFailedUpdateInfo
BreakRecordsIntoBlob
Dns_OpenTcpConnectionAndSend
DnsAsyncRegisterHostAddrs
DnsAllocateRecord
DnsReplaceRecordSetW
DnsQueryExA
DnsUpdate
Dns_WriteRecordStructureToPacketEx
DnsAsyncRegisterInit
DnsFlushResolverCacheEntry_W
Dns_RecvTcp
DnsDhcpSrvRegisterHostName
DnsQueryConfig
Dns_CloseSocket
DnsSetConfigDword
DnsDhcpSrvRegisterInitialize
NetInfo_IsForUpdate
DnsWriteReverseNameStringForIpAddress
Dns_CloseConnection
DnsRecordTypeForName
Dns_SetRecordDatalength
Dns_ReadRecordStructureFromPacket
Dns_AddRecordsToMessage
DnsCreateStringCopy
DnsNameCompare_UTF8
DnsValidateName_A
DnsFlushResolverCacheEntry_UTF8
DnsRecordCompare
DnsAcquireContextHandle_W
DnsFindAuthoritativeZone
DnsRecordSetCompare
NetInfo_Free
Dns_ParsePacketRecord
query
?SetNumberOfSortProps@CCatState@@QAEXI@Z
?LokNewWorkId@CPropertyStore@@AAEKKHH@Z
?QueryInterface@CEnumWorkid@@UAGJABU_GUID@@PAPAX@Z
??0CAllocStorageVariant@@QAE@PBU_GUID@@AAVPMemoryAllocator@@@Z
?SkipULong@CMemDeSerStream@@UAEXXZ
?GetPropInfo@CEmptyPropertyList@@QAEHABVCDbColId@@PAPBGPAGPAI@Z
??0CMachineAdmin@@QAE@PBGH@Z
?ReadProperty@CPropStoreManager@@QAEHAAVCCompositePropRecord@@KAAUtagPROPVARIANT@@PAEPAI@Z
??1CPropertyList@@UAE@XZ
?SetColumn@CCatState@@QAEXPBGI@Z
??0CWorkQueue@@QAE@IW4WorkQueueType@0@@Z
?SetLPSTR@CStorageVariant@@QAEXPBDI@Z
??0CDbNatLangRestriction@@QAE@PBGABUtagDBID@@K@Z
?IsWaitingForDocument@CFilterDaemon@@QAEHXZ
??0CRequestClient@@QAE@PBGPAUIDBProperties@@@Z
?AddChild@CNodeRestriction@@QAEXPAVCRestriction@@AAI@Z
??8CDbColId@@QBEHABV0@@Z
?My_wcstoui64@@YA_KPBGPAPAGH@Z
?UnMarshall@CDbContentVector@@QAEHAAVPDeSerStream@@@Z
?ReadPrimaryProperty@CPropStoreManager@@QAEHKKAAUtagPROPVARIANT@@@Z
?ClearList@CPropertyList@@QAEXXZ
?LookupSDID@CSdidLookupTable@@QAEKPAXK@Z
?QueryInterface@CEnumString@@UAGJABU_GUID@@PAPAX@Z
?DisableNotification@CRegNotify@@QAEXXZ
?AddDir@CCatState@@QAEXAAV?$XPtrST@G@@@Z
?GetAllEntries@CPropertyList@@UAEJPAPAVCPropEntry@@K@Z
?Release@CImpersonateRemoteAccess@@QAEXXZ
??0CCatState@@QAE@XZ
?EnumPropInfo@CEmptyPropertyList@@UAGJKPAPBGPAPAUtagDBID@@PAGPAI@Z
?GetDouble@CMemDeSerStream@@UAENXZ
?GrowBuffer@CVirtualString@@AAEXK@Z
?Next@CEnumWorkid@@UAGJKPAK0@Z
?AddArg@CEventItem@@QAEXPBG@Z
?CloseRecord@CPropStoreManager@@QAEXPAVCCompositePropRecordForWrites@@@Z
??0CMetaDataMgr@@QAE@HW4CiVRootTypeEnum@@KPBG@Z
?PutMaxValue@CValueNormalizer@@QAEXKAAKW4VARENUM@@@Z
?AddCachedProperty@CCatalogAdmin@@QAEXABVCFullPropSpec@@KKKH@Z
?Shutdown@CPropStoreManager@@QAEXXZ
?AddCatalog@CMachineAdmin@@QAEXPBG0@Z
?AcqRst@CRangeKeyRepository@@QAEPAVCRangeRestriction@@XZ
atmlib
ATMFontStatus
ATMGetBuildStr
ATMGetFontInfoW
ATMXYShowText
ATMGetOutline
ATMBeginFontChange
ATMFinish
ATMRemoveFont
ATMEnumFonts
ATMFontStatusW
ATMGetVersionExW
ATMAddFontExA
ATMBBoxBaseXYShowTextA
ATMAddFontExW
ATMRemoveFontA
ATMGetVersionExA
ATMBBoxBaseXYShowTextW
ATMFontAvailableA
ATMSetFlags
ATMGetPostScriptNameW
ATMGetMenuName
ATMAddFontA
ATMGetVersionEx
ATMEnumMMFontsA
ATMGetFontBBox
ATMGetOutlineW
ATMEnumMMFonts
ATMForceFontChange
ATMGetNtmFieldsA
ATMGetGlyphList
ATMGetFontPaths
ATMGetMenuNameA
ATMSelectObject
ATMMakePFM
ATMEndFontChange
ATMMakePFMW
ATMBBoxBaseXYShowText
ATMGetOutlineA
ATMGetPostScriptNameA
ATMXYShowTextA
kernel32
LocalHandle
SetFileApisToANSI
GetHandleContext
GlobalMemoryStatusEx
lstrcmpi
LocalAlloc
GetDiskFreeSpaceExW
GetConsoleCommandHistoryLengthW
GetConsoleCursorMode
CreateDirectoryA
CreateThread
SetHandleInformation
GetComPlusPackageInstallStatus
GetEnvironmentStringsW
CallNamedPipeA
lstrcmp
SetThreadLocale
ReplaceFileW
MulDiv
IsBadWritePtr
QueryPerformanceCounter
GetCurrentThread
UnlockFile
SetSystemTimeAdjustment
GenerateConsoleCtrlEvent
CreateActCtxW
GetVolumePathNamesForVolumeNameA
WaitForMultipleObjects
GetConsoleInputExeNameA
WideCharToMultiByte
IsValidLanguageGroup
FormatMessageA
Module32FirstW
GetConsoleCursorInfo
GlobalUnWire
Module32First
MoveFileExA
CreateMailslotW
SetComputerNameExA
_llseek
lstrlenA
CreateSocketHandle
IsValidCodePage
VirtualAlloc
RtlCaptureStackBackTrace
GetExitCodeProcess
LoadLibraryA
FindResourceW
olecli32
LeShow
BmChangeData
MfGetData
PbDraw
MfQueryBounds
OleEnumObjects
MfEqual
DibRelease
GenSetData
OleActivate
OleUnlockServer
OleQueryLinkFromClip
OleQueryOutOfDate
OleRelease
ErrSetUpdateOptions
OleClose
OleRename
ErrCopyFromLink
OleSavedClientDoc
GenSaveToStream
GenEnumFormat
LeReconnect
SetNextNetDrive
ErrObjectLong
OleQueryProtocol
GenRelease
OleSetHostNames
BmRelease
OleCreateFromClip
ObjQueryName
OleQueryBounds
DibGetData
LeCopy
WEP
PbCreateFromFile
ObjQuerySize
MfClone
LeSaveToStream
Sections
.text Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 126KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 517KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ