Static task
static1
Behavioral task
behavioral1
Sample
a3d161a702acf126e7f92672f538583a_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a3d161a702acf126e7f92672f538583a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a3d161a702acf126e7f92672f538583a_JaffaCakes118
-
Size
203KB
-
MD5
a3d161a702acf126e7f92672f538583a
-
SHA1
658430841214d49ae94271f57feadf8ecfac3d70
-
SHA256
387e70000101b4a1a843eb52dcf5a902dfea2fa0e9a4c8f024d517c033f76d7e
-
SHA512
72346847db6e76775f45ad2f8e2020f75f4211d52d84f462619cad757802188a52311627bcb11b484a029f9cc19bb5a9714da6a1ac6c8cc9279a80fe36f9c143
-
SSDEEP
3072:i7AdSSMJpyKP4qASEJHQ/OIMpZtIufjiNz1RPbLjUJsodYqROr5vnlZ/YnA:mAkSApyKCS4vJoTRPbcJsTBfB
Malware Config
Signatures
Files
-
a3d161a702acf126e7f92672f538583a_JaffaCakes118.exe windows:4 windows x86 arch:x86
24051ee6feeff87b10daaaacdb84d9b9
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01/08/1996, 00:00Not After31/12/2020, 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06/08/2003, 00:00Not After05/08/2013, 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
61:3b:f8:85:49:64:12:20:7e:cb:70:ac:fa:c6:75:5bCertificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before24/11/2006, 00:00Not After23/11/2008, 23:59SubjectCN=Qizhi Software (beijing) Co. Ltd,OU=Secure Application Development,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
lstrcmpA
WriteProcessMemory
WriteFile
WaitForSingleObject
VirtualQuery
VirtualProtectEx
VirtualAllocEx
TerminateProcess
SuspendThread
Sleep
SizeofResource
SetThreadContext
SetFileAttributesA
SetEvent
SetErrorMode
ResumeThread
ReadProcessMemory
ReadFile
PeekNamedPipe
OpenProcess
MoveFileA
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalMemoryStatus
GlobalLock
GlobalFree
GlobalAlloc
GetVolumeInformationA
GetVersionExA
GetTickCount
GetThreadLocale
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStringTypeExA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocaleInfoA
GetLastError
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetExitCodeProcess
GetDriveTypeA
GetDiskFreeSpaceExA
GetDiskFreeSpaceA
GetCurrentThreadId
GetCurrentProcess
GetComputerNameA
GetCPInfo
GetACP
FreeResource
FreeLibrary
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateProcessA
CreatePipe
CreateFileA
CreateEventA
CreateDirectoryA
CopyFileA
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
mouse_event
keybd_event
SetTimer
SetThreadDesktop
SetRect
SetProcessWindowStation
SetCursorPos
SendMessageA
ReleaseDC
PeekMessageA
OpenWindowStationA
OpenDesktopA
OpenClipboard
MsgWaitForMultipleObjects
MessageBoxA
MapVirtualKeyA
LoadStringA
GetThreadDesktop
GetSystemMetrics
GetProcessWindowStation
GetLastInputInfo
GetDesktopWindow
GetDC
GetClipboardData
ExitWindowsEx
EmptyClipboard
CloseWindowStation
CloseDesktop
CloseClipboard
CharNextA
CharToOemA
MessageBoxA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
GetUserNameA
AdjustTokenPrivileges
StartServiceA
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
oleaut32
SysFreeString
SysAllocStringLen
gdi32
SetDIBColorTable
SelectPalette
SelectObject
RealizePalette
PatBlt
GetSystemPaletteEntries
GetStockObject
GetPaletteEntries
GetObjectA
GetDeviceCaps
GetDIBits
GetDIBColorTable
GdiFlush
DeleteObject
DeleteDC
CreatePalette
CreateHalftonePalette
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
BitBlt
wsock32
WSACleanup
WSAStartup
WSAGetLastError
gethostbyname
socket
shutdown
send
recv
ioctlsocket
inet_addr
htons
connect
closesocket
shell32
ShellExecuteA
SHGetFileInfoA
SHFileOperationA
ShellExecuteA
psapi
GetModuleFileNameExA
avicap32
capGetDriverDescriptionA
capCreateCaptureWindowA
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
HttpQueryInfoA
ntdll
ZwUnmapViewOfSection
Exports
Exports
1�a���"��m������8���1�Ƣ �:�m�Gt�T��d&��L�d�7 |�}]Ą�y�*OU*�����T��=��g�_-�οQ^��⅐���P�岱W������\!�@�6�$�L���s���ۙ���&�Z�g���xTs>7:��^�cs��?}��`hE�����f����ZMIw�`Ԧc ��p ��� q�cn�G�D�7��,�_�2���o� mi�gKƑ>�gA��i._@3�d�Z- ϯqkU��+�o���������w1g���֚귱+����f~��݈� ��b��G�!L����B�V��>'��ݏ�s4�sEȞ����u�����:�Yd)�&i����y+˲0�/�m�g�J�2�6�bަ�3������ �t�µׇ�a3Y��.��`c�W������J S�����J//+M��Mړ�ѱs��a�UG���0?)r�+�^^O7�W9/Y�Ǻ:WQ�`cv@h�3hҜ�u�95�6n��G�t�����t�`�&$$�*@�"��q��x�q &��&A�[�\>I����CeR�}N�t��[ɱ�Һ�,�=��Qm8D�A1�/�¿����o��)�x�S��e�$�f��q+�2fZf{R"��x�'OOp=������=y���%� *�돼"�C5��g�.x�����3�5���T�fM�N����N�<��[e;B��':z�"�,\cuX���K��|�ey*y���e+��I`�21���c�DQ´�=3���xPp5�Y�ܶ0)'}�a�;���n�mę)��)�O�4Z<>VǑ-�L��R\|��|t��~��������6���gv̦���:K/�&2R����n� �p�J�e#���K��Y� V��oLʨ˾C� :e���z<F���e����c����э�왌u7�gߎ����L�d[���4M*\�H���{�1E[M�Ӎ��m'Gš����f젫)F��#�u�:��Ė����o�KEh�� l��Kj����6&a�S��@z��^��a�NO"X�m��E������t��p(��iB ��x|��f�Z��W����c瞘�(��kq^K[ �Z*���SC�csV��(.�eGg��T:�v4hs���*wP$��R��j1�����{�C ��h Ͼf ���WT�q��C���]��5�Z��Ӌ!m*���sʄC��6�!�̀F���b��W���b��l���FiN�?\b�muƓ��A�A.�L����6Ɇ��X*�֡������2��$����o?�e���,��^���47B�^4~Z,x@���I��trΆS����mi> ��I���{G�T�Ӱ�,�9��7�ANp�_m�����k[��}�LPf�{�z����(S[��Sp��(m��|Z~�������/VQ��4�~<������������Ҿ�����{��-ii^��xs~��ӦL�K�t�MT����m� ��I�qGG���[����K+��|V$sZ:��g��v75�Z�������L�K�,s�����p���i���>���?�%،Oσ� 3�e�26�E-�ֻ��?hs&W����_n�T�]�(�Ep��<�=�cm$�b2��-��;�9;�c!��}\�{��X��M'�� eC�ܧ��1Z<�L�R��?�@|E �H4�hWq�6 ��6X����cp-����<���OtS�M>(7d+�g����q�8}��\>��Y<p������4֟<�a�c,�l��Tq�ޞ*�=&L�����0=}B���(Kh���Ք� pR.���Ѱ���d����{끜�Ϭ���.v,��Gy���Q ��Ǩ�D�γ�N��u�·�P$ yw�i9�bA��1I2f[FKff�#���8���Q�Ю�<;d���t�趓t��}S�2��|n0��=3���Lv(1��� 讔��L�� s�D�!7\�4s�k!���L"Nq_&��ې�Ô#^'�2'P�uP��R�cO�������.��Ѯ��G���黢��}q��x������(�� aTa�aPO����Mbk��ŷ+@�Ԋ3x����%l�]����W���d�!W����1��'���8cSU�V&6�T}��&�������c�F{*�m��ei�������ƥ�t2�D��zh��D�dAAP���F]�x��I0��{�P��n>k2,q˂/�D���W���L �(��#�j��L������:p��SI̭���T�S�_�����"��~��6��I�H!���!�]1��6��_�])��?�k�kC��8ӡ�-�-5�5~q�*ChpP�#aC%>�%-%��,m�B9$5��l�W�/$M�ğ�����\?s�������a���Ab1{�epk&��3�J ���iƿ[y6�:b�d� ��5���q�rЋ���P ��[('ʪߚ[V�)���TE����.�J�G���x ���;oV9X�W�;���碩���`��� ����`��HI����Ŏ��K 6���NA~�c,�^���*��x&�I$������>��}���A�f��#��@���˻���hfH����w��������ȫ?H�M�i$W�d�i���5�|�^����GE(YDU�fF�bf�{>��sd��85U��H�*4,�����N�S}�C��J��.�;��K��N�#|�� ���Pv�e��ۖ�����o �o�����A[Y�C��.��ϲ����&���ľ���r�y~\]<NP��aP�-� �Woh��I����d���Ӈ��R��{ @����)O��<X�"���i=����\��� ��e~�H�L��N=c��)F�p}f�,��-��Z�%U�_�����_�ȯM�&���0l|ð�Io"{��Ԃk�����]�$A� ��5��b������8��CqASөxވk���}�;P�' �?1�01�qr��d�=8D,�+K�����H ���+�=�v�:.��M��P @w*���T|o�vo������ڤ̖ۓ�k�:�X��ͩ�NvY�Ą-�
Sections
CODE Size: - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ