Static task
static1
Behavioral task
behavioral1
Sample
93e224f1ca2c6a0a98c7a7441642d3f0_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
93e224f1ca2c6a0a98c7a7441642d3f0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
93e224f1ca2c6a0a98c7a7441642d3f0_JaffaCakes118
-
Size
760KB
-
MD5
93e224f1ca2c6a0a98c7a7441642d3f0
-
SHA1
eb4de891b6bacd2a7e02b528257673069947b7a0
-
SHA256
dfbd3ae0d5bdaa09c5471c3f166529ecd65c1e47b3ee8e65883ae87b5ab9b104
-
SHA512
024596ef156d75a74ce74e8c44421df112d96fccfce89c74276d4b625e597f94c69e4d7b45c8459f7e835c60f61be688e94ac38357378df26f0aecf21802fa7a
-
SSDEEP
12288:tpBwVDZkBG7nfS8MOYIcJp5tuDFSMNyCDwjdvDbmpkDoGrkOpfetVj:5S6mG8EELo5bmZGBEjj
Malware Config
Signatures
Files
-
93e224f1ca2c6a0a98c7a7441642d3f0_JaffaCakes118.exe windows:4 windows x86 arch:x86
f2c23a99b4cfeb523ade7e64390537a5
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01/08/1996, 00:00Not After31/12/2020, 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06/08/2003, 00:00Not After05/08/2013, 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:ddCertificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before22/10/2008, 00:00Not After23/11/2010, 23:59SubjectCN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
SetCurrentDirectoryA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
MessageBoxA
advapi32
RegDeleteKeyA
oleaut32
VariantInit
version
VerQueryValueA
gdi32
GetDIBColorTable
ole32
CoInitialize
comctl32
ImageList_ReplaceIcon
shell32
SHGetFileInfoA
quartz
AMGetErrorTextA
wsock32
htons
Exports
Exports
|z=-��(!i���}��t}��,~���k:�2�����P<���<�ah�<��ə����t�&ӄ���R��D.��%b��B-���1�,��uq�V���^#���i�1f��)����"�d9��9#P�.�j�1�=K=70Ӱ�S6��d�v��/��ǩ3� ��~@Kyܠ��W#��i�^�dI�PB���������K@Uk�-���� ��:�&�]fk�yZO�mټ��=����� 1`$���v7ّ�X*�P]�O۽> ��ݙ��� lc���d��)<��i�_%8���d�5\��X�9��(�.d~���,�>L����G��nMoy���`kP��H�?7�����%r_t�n�؋�o}�!G4��[�S�;�����Ґ:��,2[��(=����Ҧ��@'W D%��֑ � ���'X�\�t(-�����n�Y�ܷ�=��],!� =$%�) �%ݎ&�unͿ �E��H��o�Q\xD�D#M�s] �����Q\HM� �-�q6Z%��+&�̝{#l��Ͼd���YRH �P���Pɻ�wl�� ��AX��[�7�`��e�QG�/��;x�@�� qO�k }���������E�Ө4����N"���,;��NA�ω+��!Z����揣z͒i�zZ�O߬�Z5*mfH{�q��E)6㡲M� ���E "ܮ������ '�3A�(}�f.YyTS�1�@ז�=��"��9z#FQgmz���m������=B�hم�a�����!�V�D�uQ0�g�緸��zh��V��D��4��))�1=J�p�O� ��zP��<�l���;����K)�@��K���l"�������6LNC���F�Bf�o8�Oo�i���6�^H��ڰC�dX �o���J��>~5-{�F,�P �=����e�������ε��P 9�#���f�+�X5� �P�<�4OT A�aAvu�����hM� O�7�/���b�#�j�~U��\�C��d���*���p��y�f��bB�'Ș�{ܿ�d' b�����%��I�/��1v6-G�@����<��&��2~��q����/kz��}oZ�o��ȅ���ʳ����vC%fx5*�Sx�&���q�F�o(:66W�#�����h��-K�Z0�^z��m$�μ�Z4�s����B�!����ʌP%AV��>�z�;�����蟻�z�(�-����Z���N�F���)��Np�D��Ѥ�=#��Q -�נ0:�F��U�tMNao�;e�ʁ��y6F�� ��2�&�&��ƼwM&�|�?��DI��,c�I�E���粵-Ic*<7�=�ڌǙ�����A��Ra��җ�#l�������a�����;�����}����/5����8��4$�,��M%�>5']���~U""c�H�w���q�{Vє�;��6j�?}�6H@*w�&Xn�/QE���?d�~�;amfR�/oL��6bK�a{7E��' ��o��xѽ�ry�#�7����k�/�Q��5=���v�n��j]k+:������uj�/�w38��0Ӄ�V�[pr~3P\��ɱE�xN5��F��#yi^�jN��ꮢ/��2NY������MPH�ZƜx�o��R�E�S�NKTA2�b�s�G<b�ۻ�: ��<����N4��`�Cҍ��Sn�@��P���Q���M��: 3��&�T�ֈ��(a��{@>���n�~Y����4f�9ѩh�4NUtA�/Hf�S�uJ��k��:��h��S;Io��)�Z9�Hz�(�V#��&���T0��ߒ \�|{��ڨ�a�@Y�Mb�倍 ���������a; ��f�+�x�7�F���X��|jJ�"y�?�yu�G`R�m_I�|I�����zkÂs'"�zI����ai{����ZR�̏�T+��&4�9ύ����q������c����z��b����)���]h���z7���Z*�6��1/����.V�<�U16��Nh�I�2�!0Ύ���QɆTbi<���P�g2�s�H�����ҷ7:g?� ���� ��]�8)e�Y��&d=��Gz=V?�c;��g�W������W��r�ª�.���H����K��)�qQ��k'+k�9s��)���`�f9��j�� p�%t4��I�Ì�L� ~4�(5���[�Kvx��h�r��/��$�����"�{e6ܳ&q��i����w>�MP��8\U#m=�i˜�WR�����<:F�4�`*����o_��x�TKM�ޔ�/�s�<�%����O[t�zc���X$���~��f����uo{�X��;B���ȕXI�`��"s���,�˻�i��"��˽��7���ǃ\�/�2aZ�����Қ�Ԯ�$-��J�>�a��!NvV'�ŏHE9nNB<��)X_L0i�DZf@|���{��u�8��a�T�U����ϛj��&f�=Bk��Kϊ�,���y�=��7P����ȵ��+��̈:{,t�-�t0t�U���\0��YιJ�5���}�W��hS#j��y��q`�l��3��A��gQ�q̧N�[�b8�4}btct�l 2���y��:Pb�G6,�9�(Z<s�����NQ��Wg��D�j�s�x��}^�M�S$K��˗�: �|���ʮe�h#�HyB��j��Wz-Raq�0\jO�Wи[�e/�}g*v���\ ��3���M�({�ZO<�.���� =@ID�2��>�H]��Μ�ʗ�TǃjX�;{X�]��MNFj��I�BcA�����Ժ�ȣxJ�xA��A�u�v+�:`%r�F>{�g�"�1 �=�t��=��Wkn��b���!��R� ~Ff~�Sf�٢Oܺ��+GA)����q�tsx�]qs� 9��J�i{k�5Q|X�e�~�9͊�C�NP���<�����1_TK�wG-)2>p���a&�N9����t.�d��:��^��*j�ҹ�/� t��Y��d�}gQ{��4��#~x��'�6l�&ֈ��`���%Җ܂����f�}O/iֵ��l�G���%,?&s!��*(�)8�6A_�@�� V�F*a�&
Sections
.tect Size: - Virtual size: 608KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tect Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect Size: - Virtual size: 9KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tect0 Size: - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect1 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect Size: - Virtual size: 230B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect2 Size: - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect3 Size: 751KB - Virtual size: 751KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ