Static task
static1
Behavioral task
behavioral1
Sample
a0b37d46e1af096a758882bb3d43d161_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a0b37d46e1af096a758882bb3d43d161_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a0b37d46e1af096a758882bb3d43d161_JaffaCakes118
-
Size
860KB
-
MD5
a0b37d46e1af096a758882bb3d43d161
-
SHA1
8e333ace553f8d2cbb1a45e805cd93d46557e9cd
-
SHA256
e4d35f994a3cd735d12c6df5c4d36698db36a62e707e1b1d560793ad2aa70109
-
SHA512
ff62ca4710c27f07a0d2df5f6c9b8b6de3d5251c79e9004f486f1da399621bd3f88217941872c5cda10688fae117bfd25a61f297e1a698b49e75d97d93f22864
-
SSDEEP
24576:0moz+Z9/lWTR70fxUE7Xdx4FWMWjL7Q98:bozK9/lWTR70fxbzkK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0b37d46e1af096a758882bb3d43d161_JaffaCakes118
Files
-
a0b37d46e1af096a758882bb3d43d161_JaffaCakes118.exe windows:5 windows x86 arch:x86
90328f74ca5956c1702c3831caba175d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryPerformanceCounter
UpdateResourceW
GetNumaNodeProcessorMask
CreateRemoteThread
GetStringTypeW
OpenFile
CreateJobObjectW
SetConsoleLocalEUDC
SetCurrentDirectoryA
CreateSocketHandle
SetEndOfFile
Heap32ListFirst
CreateTimerQueue
FindActCtxSectionStringW
VirtualAlloc
OpenProfileUserMapping
GetStringTypeExW
GetVolumePathNamesForVolumeNameW
SleepEx
GetTickCount
SetCommBreak
OpenSemaphoreA
ReadConsoleOutputCharacterA
GetConsoleTitleA
SetConsoleNumberOfCommandsW
ReadDirectoryChangesW
Heap32Next
LCMapStringW
lstrcpyW
GetFileAttributesExA
CreateConsoleScreenBuffer
DefineDosDeviceA
GetExitCodeProcess
DeleteFileW
SetProcessShutdownParameters
GetProcessTimes
WriteConsoleA
GetProcAddress
MulDiv
GetPrivateProfileStringW
SetInformationJobObject
CreateJobSet
HeapDestroy
CreateMemoryResourceNotification
ReadConsoleOutputAttribute
WaitForSingleObject
VirtualProtectEx
GetCompressedFileSizeW
EnumerateLocalComputerNamesA
SetEvent
SetConsoleMode
SetFileAttributesW
DebugBreakProcess
DebugActiveProcess
FindResourceW
LoadLibraryA
OpenThread
WaitForSingleObjectEx
SetNamedPipeHandleState
Beep
RtlCaptureContext
LocalFlags
FormatMessageA
ConvertFiberToThread
SetConsoleWindowInfo
GetProcessWorkingSetSize
GetOEMCP
SetConsoleMenuClose
GetFileAttributesW
SetDefaultCommConfigW
ChangeTimerQueueTimer
CreateProcessInternalA
FindFirstVolumeMountPointW
SetEnvironmentVariableW
DeleteTimerQueue
GetVolumeInformationA
BeginUpdateResourceA
IsDBCSLeadByteEx
FileTimeToSystemTime
LCMapStringA
LoadLibraryExW
DeleteFileA
PeekConsoleInputA
ReadConsoleInputExA
GetPrivateProfileStructW
FreeEnvironmentStringsA
CloseHandle
RemoveLocalAlternateComputerNameA
ClearCommBreak
SetThreadExecutionState
GlobalFix
GetConsoleCursorMode
ConvertDefaultLocale
FindNextVolumeMountPointW
GetFileTime
GetNumberFormatW
EnumResourceTypesA
CreateMutexA
IsBadStringPtrW
RegisterConsoleIME
CreateEventA
FindNextChangeNotification
DeactivateActCtx
OpenFileMappingW
VerLanguageNameA
WriteProfileSectionA
DebugBreak
DosPathToSessionPathW
GetSystemDefaultLCID
CompareStringW
GetConsoleAliasesW
InitializeCriticalSectionAndSpinCount
CreateFileMappingW
GetOverlappedResult
GlobalAddAtomA
GetConsoleAliasExesA
FlushFileBuffers
SetFileShortNameW
GetBinaryTypeW
WaitForMultipleObjectsEx
query
??0CQueryScanner@@QAE@PBGHKH@Z
??0CSdidLookupTable@@QAE@XZ
?OpenRecord@CPropStoreManager@@QAEPAVCCompositePropRecord@@KPAE@Z
?Remove@CColumns@@QAEXI@Z
??1CNotRestriction@@QAE@XZ
?Read@CRcovStrmTrans@@QAEKPAXK@Z
_AbortMerges@16
??1CImpersonationTokenCache@@QAE@XZ
?AddArg@CFwEventItem@@QAEXK@Z
?SetProperties@CDbProperties@@UAGJKQAUtagDBPROPSET@@@Z
?NotifyWriteRead@CRequestClient@@QAEHPAX0K0KAAK@Z
?Value@CDbScalarValue@@QAEXAAVCStorageVariant@@@Z
?Next@CEnumWorkid@@UAGJKPAK0@Z
?_FindOrAddAnchor@CDbSortNode@@AAEPAVCDbSortListAnchor@@XZ
??0CDbSortSet@@QAE@I@Z
?ChangeDirty@CPropStoreInfo@@AAEXH@Z
??1CContentRestriction@@QAE@XZ
??1CPerfMon@@QAE@XZ
?StopCI@CMachineAdmin@@QAEHXZ
?AddMachine@CCatState@@QAEXAAV?$XPtrST@G@@@Z
CITextToSelectTree
??1CNodeRestriction@@QAE@XZ
?GetDiskSpace@CDriveInfo@@QAEXAA_J0@Z
??4CDbColId@@QAEAAV0@ABV0@@Z
?ReportEventW@CEventLog@@QAEXAAVCEventItem@@@Z
?GetNumber@CQueryScanner@@QAEHAA_JAAH@Z
?ExtensionHasScriptMap@CMetaDataMgr@@QAEHPBG@Z
?EnumerateValues@CRegAccess@@QAEXPAGAAVCRegCallBack@@@Z
?GetUShort@CMemDeSerStream@@UAEGXZ
?PutValue@CValueNormalizer@@QAEXKAAKABVCStorageVariant@@@Z
?Unmap@CRcovStrmTrans@@IAEXW4DataCopyNum@CRcovStorageHdr@@@Z
?Next@CPropertyList@@UAEPBVCPropEntry@@XZ
?Init@CSdidLookupTable@@QAEHPAVCiStorage@@@Z
?SetDWORDParam@CMachineAdmin@@QAEXPBGK@Z
CIBuildQueryNode
??0CSvcQuery@@QAE@PBGPAUIDBProperties@@@Z
?GetChar@CMemDeSerStream@@UAEXPADK@Z
??0CTimeLimit@@QAE@KK@Z
??1CScopeEnum@@QAE@XZ
??0CPerfMon@@QAE@PBG@Z
?SetWeight@CDbCmdTreeNode@@QAEXJ@Z
?SetColumn@CCatState@@QAEXPBGI@Z
?GetR4@CAllocStorageVariant@@QBEMI@Z
??0CPropNameArray@@QAE@AAVPDeSerStream@@@Z
msvcrt40
??0istream_withassign@@QAE@XZ
?_query_new_handler@@YAP6AHI@ZXZ
_locking
??_7stdiostream@@6B@
??_7bad_typeid@@6B@
wcsrchr
??_Gostream@@UAEPAXI@Z
_errno
_ismbcalnum
??_7ofstream@@6B@
_ismbbalnum
??_7ifstream@@6B@
_safe_fdiv
_fileno
_CIsinh
?peek@istream@@QAEHXZ
_adj_fprem1
_pgmptr
?xsputn@streambuf@@UAEHPBDH@Z
?setb@streambuf@@IAEXPAD0H@Z
?text@filebuf@@2HB
?_set_new_mode@@YAHH@Z
modf
__lconv_init
_CIacos
wcsncpy
_wfsopen
?pbump@streambuf@@IAEXH@Z
??_Dstdiostream@@QAEXXZ
?fail@ios@@QBEHXZ
oledlg
OleUIBusyA
OleUICanConvertOrActivateAs
OleUIUpdateLinksA
OleUIAddVerbMenuA
OleUIChangeSourceW
OleUIUpdateLinksW
OleUIChangeIconA
OleUIObjectPropertiesA
OleUIPasteSpecialA
OleUIObjectPropertiesW
OleUIEditLinksW
OleUIEditLinksA
OleUIConvertA
OleUIInsertObjectA
OleUIChangeSourceA
OleUIInsertObjectW
OleUIConvertW
OleUIChangeIconW
OleUIPromptUserA
OleUIPasteSpecialW
OleUIPromptUserW
OleUIBusyW
OleUIAddVerbMenuW
Sections
.text Size: 347KB - Virtual size: 347KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 361KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 148KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ