Static task
static1
Behavioral task
behavioral1
Sample
acfdf3b0ebd896f0b43e05027b42aa32_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
acfdf3b0ebd896f0b43e05027b42aa32_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
acfdf3b0ebd896f0b43e05027b42aa32_JaffaCakes118
-
Size
988KB
-
MD5
acfdf3b0ebd896f0b43e05027b42aa32
-
SHA1
670b420e9527af5c973476dbc983c97615170bfc
-
SHA256
f32f50f9c31ac7b750b4f60016173435475655eb9d926abfb48b7267a3f6b6a0
-
SHA512
7825a783b2ee75361356c996453479b454fd3cc4048e2e02e81355e946c111fad66dab159ac1b11ec2cf096316be7d9f4d586165235ac2f1942e236b5ba94bd9
-
SSDEEP
6144:/I8ca0KqF+YdX2+q+nL2btejHGuTUMavDBCLV4lNZMt9eZaA1k4jdLjFDKKLfQkz:sa7e+XeLavDYsZuqlGpwo8vGl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource acfdf3b0ebd896f0b43e05027b42aa32_JaffaCakes118
Files
-
acfdf3b0ebd896f0b43e05027b42aa32_JaffaCakes118.exe windows:4 windows x86 arch:x86
efda47bd2ead0bfd54af9d188e6ae272
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetUseConnectionA
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
kernel32
GetEnvironmentStrings
SetHandleCount
GetStdHandle
SetUnhandledExceptionFilter
GetDriveTypeA
IsBadReadPtr
IsBadCodePtr
FreeEnvironmentStringsW
GetEnvironmentStringsW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetStringTypeW
FreeEnvironmentStringsA
UnhandledExceptionFilter
VirtualAlloc
GetStringTypeA
IsBadWritePtr
HeapDestroy
VirtualFree
HeapCreate
LCMapStringW
LCMapStringA
GetACP
GetTimeZoneInformation
GetFileType
HeapSize
HeapReAlloc
RaiseException
SetStdHandle
ExitThread
GetLocalTime
ExitProcess
GetStartupInfoA
RtlUnwind
FileTimeToSystemTime
SetErrorMode
FileTimeToLocalFileTime
GetCurrentDirectoryA
SizeofResource
GetCPInfo
GetOEMCP
LocalReAlloc
GlobalFlags
TlsGetValue
GlobalHandle
TlsSetValue
TlsFree
GetProcessVersion
TlsAlloc
LocalAlloc
GetStringTypeExA
GetShortPathNameA
GetThreadLocale
SetEndOfFile
GetVolumeInformationA
MoveFileA
FlushFileBuffers
UnlockFile
LockFile
ReadFile
SetFilePointer
WriteFile
GetCurrentProcess
DuplicateHandle
LocalFileTimeToFileTime
CreateFileA
SystemTimeToFileTime
GetFileTime
GetFileSize
GetDiskFreeSpaceA
FindNextFileA
SetFileTime
GetTempFileNameA
SuspendThread
lstrcmpA
GetCurrentThread
GetPrivateProfileStringA
SetThreadPriority
WritePrivateProfileStringA
lstrcmpiA
GetPrivateProfileIntA
SetLastError
GlobalGetAtomNameA
GlobalFindAtomA
GlobalDeleteAtom
InterlockedIncrement
GlobalAddAtomA
GetVersion
OpenProcess
GetCurrentProcessId
CreateProcessA
ResumeThread
TerminateProcess
GetTickCount
GlobalUnlock
GetModuleHandleA
GlobalLock
CreateEventA
SetEvent
FindFirstChangeNotificationA
FindNextChangeNotification
HeapFree
GetModuleFileNameA
MultiByteToWideChar
InterlockedExchange
MulDiv
lstrcatA
lstrcpynA
lstrlenA
GetWindowsDirectoryA
WideCharToMultiByte
InterlockedDecrement
LocalFree
FormatMessageA
GetCurrentThreadId
HeapAlloc
GetProcessHeap
FreeLibrary
LoadLibraryA
GlobalFree
LockResource
LoadResource
FindResourceA
GlobalReAlloc
GlobalAlloc
lstrcpyA
CreateThread
GetFullPathNameA
DeleteCriticalSection
GetLastError
DeleteFileA
lstrlenW
GetProcAddress
SleepEx
GetFileAttributesA
WaitForSingleObject
GetExitCodeThread
FindClose
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WaitForMultipleObjects
GetProfileStringA
FindFirstFileA
Sleep
CloseHandle
user32
EnumThreadWindows
SetFocus
DeleteMenu
AppendMenuA
GetWindow
IntersectRect
DrawEdge
ExitWindowsEx
GetClipboardData
OpenClipboard
SetClipboardData
CloseClipboard
SetForegroundWindow
EnableMenuItem
PostThreadMessageA
ShowWindow
IsWindowEnabled
GetDlgItem
ScrollWindow
SetWindowPos
SetDlgItemTextA
IsWindow
TrackPopupMenu
DestroyMenu
KillTimer
SetTimer
GetMenu
LoadIconA
LoadMenuA
EqualRect
MenuItemFromPoint
GetMenuItemInfoA
GetTabbedTextExtentA
DrawStateA
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringA
ModifyMenuA
GetMenuState
GetFocus
GetWindowLongA
GetScrollInfo
PostMessageA
DefFrameProcA
CharUpperA
SetWindowLongA
LoadImageA
CopyIcon
GetDesktopWindow
MessageBoxA
IsWindowVisible
LockWindowUpdate
ShowScrollBar
ScreenToClient
SetCursor
SetScrollPos
EnableScrollBar
GetAsyncKeyState
GetMenuItemRect
SetRect
MapWindowPoints
InvalidateRect
CopyAcceleratorTableA
GetClassNameA
FrameRect
SetRectEmpty
RegisterWindowMessageA
GetMessageA
IsZoomed
ShowOwnedPopups
GetKeyState
SendMessageA
GetDCEx
ReleaseCapture
SetCapture
RedrawWindow
PtInRect
GetWindowRect
OffsetRect
GetClassLongA
FillRect
GetSysColor
ReleaseDC
CopyRect
InflateRect
ClientToScreen
GetParent
BeginDeferWindowPos
EndDeferWindowPos
IsRectEmpty
GetClientRect
SystemParametersInfoA
PostQuitMessage
DestroyCursor
SetCursorPos
SetScrollInfo
GetScrollRange
SetScrollRange
GetScrollPos
GetTopWindow
RegisterClassA
FindWindowA
EndDialog
CreateDialogIndirectParamA
SetWindowPlacement
GetWindowTextLengthA
GetWindowTextA
DestroyWindow
CreateWindowExA
SetPropA
GetPropA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
GetWindowPlacement
GetLastActivePopup
IsIconic
UnpackDDElParam
ReuseDDElParam
SetActiveWindow
WinHelpA
GetClassInfoA
GetActiveWindow
PeekMessageA
TranslateAcceleratorA
LoadAcceleratorsA
DeferWindowPos
DefWindowProcA
GetCapture
DestroyIcon
DrawMenuBar
InvertRect
UpdateWindow
TranslateMDISysAccel
GetSystemMetrics
LoadBitmapA
BringWindowToTop
ValidateRect
WindowFromPoint
IsChild
DrawIconEx
DrawFrameControl
RemoveMenu
InsertMenuA
GetSystemMenu
GetDlgCtrlID
CheckMenuItem
CallWindowProcA
MessageBeep
SetWindowsHookExA
TrackPopupMenuEx
UnhookWindowsHookEx
CallNextHookEx
SetMenu
CreateMenu
LoadStringA
DrawTextA
EnableWindow
SetParent
MapVirtualKeyA
GetKeyNameTextA
GrayStringA
BeginPaint
TabbedTextOutA
EndPaint
GetWindowDC
GetDC
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetWindowTextA
GetNextDlgTabItem
MoveWindow
IsDialogMessageA
SendDlgItemMessageA
wsprintfA
AdjustWindowRectEx
GetCursorPos
TranslateMessage
DispatchMessageA
SetMenuItemInfoA
CharNextA
LoadCursorA
GetSysColorBrush
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
DrawFocusRect
DefDlgProcA
IsWindowUnicode
gdi32
StretchBlt
ScaleViewportExtEx
GetDeviceCaps
GetTextColor
PatBlt
GetTextCharsetInfo
CreateRectRgnIndirect
CreateFontIndirectA
Polygon
CreateSolidBrush
GetTextExtentPoint32A
GetTextMetricsA
GetStockObject
GetObjectA
CreateBitmap
BitBlt
DeleteObject
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
RealizePalette
CreateHalftonePalette
Ellipse
GetDIBColorTable
CreatePalette
SetTextColor
SetBkColor
GetClipBox
CreatePatternBrush
SetRectRgn
CreateRectRgn
ExtTextOutA
CombineRgn
DeleteDC
DPtoLP
RestoreDC
SelectPalette
SaveDC
SetBkMode
SetMapMode
SetViewportOrgEx
SetStretchBltMode
SetViewportExtEx
SetWindowOrgEx
OffsetViewportOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExcludeClipRect
IntersectClipRect
SelectClipRgn
MoveToEx
LineTo
SetTextAlign
CreatePen
RectVisible
TextOutA
PtVisible
LPtoDP
StretchDIBits
Escape
CreateFontA
GetCharWidthA
GetTextExtentPointA
CreateDIBitmap
comdlg32
ReplaceTextA
FindTextA
GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
advapi32
RegSetValueA
QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
StartServiceA
ControlService
DeleteService
GetUserNameA
InitiateSystemShutdownA
QueryServiceConfigA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
EnumServicesStatusA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegQueryValueA
GetFileSecurityA
RegCreateKeyA
RegOpenKeyA
RegEnumKeyA
SetFileSecurityA
shell32
ExtractIconA
DragFinish
SHGetFileInfoA
DragQueryFileA
SHGetSpecialFolderLocation
SHBrowseForFolderA
Shell_NotifyIconA
SHGetMalloc
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA
DragAcceptFiles
comctl32
ImageList_Draw
ImageList_AddMasked
ImageList_GetImageInfo
ord8
ImageList_GetIcon
ImageList_BeginDrag
ImageList_DragShowNolock
ImageList_EndDrag
ImageList_DragLeave
ImageList_DragMove
ImageList_DragEnter
ImageList_LoadImageA
ImageList_GetImageCount
ord17
ImageList_Destroy
ImageList_Create
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
SysStringLen
SysAllocStringLen
VariantInit
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantClear
SysStringByteLen
sapfeilg
?FeiStopLog@@YAXK@Z
?FeiStartLog@@YAXKPBD0H@Z
?FeiGetPrivateProfileStringA@@YAKPBD00PADK0@Z
?FeiVarInitWin32Message@@YAXKKPBDID@Z
?FeiVarWriteWin32Message@@YAXPBDZZ
?FeiWriteLogSetEnv@@YAXKPBDID@Z
?FeiWriteLogEnv@@YAXPBDZZ
?FeiWriteWin32Message@@YAXPBDKK0DI@Z
sapfeiui
FeiSetProgress
??0CFeiWizardAccountPage@@QAE@PBD00@Z
??0CFeiWizardAccountPage@@QAE@PBD@Z
?AddFile@CFeiWizardShellPage@@QAEXPBG000K@Z
?IncProgress@CFeiWizard@@QAEXXZ
?ShowProgress@CFeiWizard@@QAEXHI@Z
?GetWizard@CFeiWizardPage@@QAEPAVCFeiWizard@@XZ
??1CFeiWizardShellPage@@UAE@XZ
??0CFeiWizardShellPage@@QAE@W4Columns@0@PBDW4Styles@0@@Z
?EnableBrowseForFile@CFeiWizardOptionsPage@@QAEXHHPBD0@Z
FeiOpenProgress
??1CFeiWizardAccountPage@@UAE@XZ
??1CFeiWizardInstallationSourcePage@@UAE@XZ
??0CFeiWizardInstallationSourcePage@@QAE@PBDH@Z
??1CFeiRollbackCache@@QAE@XZ
FeiEnableCancel
?UndoAll@CFeiRollbackCache@@QAEHXZ
FeiLockedModuleDialogW
?Add@CFeiRollbackCache@@QAEHPBG@Z
FeiSetProgressText
??0CFeiRollbackCache@@QAE@XZ
FeiCloseProgress
??0CFeiWizardOptionsPage@@QAE@PBD@Z
?EnableBrowseForFolder@CFeiWizardOptionsPage@@QAEXHIH@Z
?SetOption@CFeiWizardOptionsPage@@QAEXIPBD@Z
??1CFeiWizardOptionsPage@@UAE@XZ
?SetDefault@CFeiWizardOptionsPage@@QAEXI@Z
?GetSelectedIndex@CFeiWizardOptionsPage@@QAEIXZ
?FeiSubclassStaticControl@@YAHPAUHWND__@@PBD1@Z
??1CFeiWizard@@UAE@XZ
??1CFeiWizardInfoPage@@UAE@XZ
?Show@CFeiWizard@@QAEIH@Z
?AddPage@CFeiWizard@@QAEHPAVCFeiWizardPage@@@Z
??0CFeiWizardInfoPage@@QAE@PBD0HPAUIDispatch@@@Z
??0CFeiWizard@@QAE@PBD000IIPAUHWND__@@@Z
?FeiOpenURL@@YAXPBDH@Z
?Fei_IsFontAvailable@@YAHPBD@Z
?FeiHtmlDialog@@YAJPBDPAUHWND__@@HHHHHHHPAUtagVARIANT@@2@Z
?WMR_ONHYPERLINK@@3IA
?GetSelected@CFeiWizardOptionsPage@@QAEPBDXZ
sapfeiut
??0CFeiConfigMgr@@QAE@XZ
?close@CFeiRegKey@@QAE_NXZ
?GetCfgString@CFeiConfigMgr@@QAE_NPBD0PADK@Z
?SetCfgString@CFeiConfigMgr@@QAE_NPBD00_N@Z
??1CFeiConfigMgr@@QAE@XZ
?remove@CFeiRegKey@@QAE_NXZ
??0CFeiRegKey@@QAE@PBD00K@Z
?GetServerShare@CFeiInstServer@@SAPBDXZ
?GetServerHost@CFeiInstServer@@SAPBDXZ
?GetWkstaPlatformID@CFeiRemoteWksta@@SAKPBG@Z
?open@CFeiRegKey@@QAE_NPBDK@Z
??1CFeiRegKey@@QAE@XZ
?FeiGetSapWkstaPath@@YAPBDPBD0@Z
?Create@CFeiObjectSecurity@@QAEHPAV1@@Z
??BCFeiRegValue@@QAEPBDXZ
?exist@CFeiRegValue@@QAE_NXZ
??ACFeiRegKey@@QAE?AVCFeiRegValue@@PBD@Z
?IsAvailable@CFeiInstServer@@SAHPBD@Z
?GetServerRightsProvider@CFeiObjectRightsImpl@@SAPAUIFeiObjectRights@@XZ
?RegisterDocumentType@CFeiTools@@SA_NPBD0000IH0@Z
?DoesExist@CFeiFile@@SAHPBD@Z
?SaveFileCrcToRepository@CFeiCrc32@@KAKPBD@Z
?SetSessionServerPath@CFeiInstServer@@SAXPBD@Z
?SetSessionRegPersistence@CFeiInstServer@@SAXH@Z
??1CFeiMultiSzRegValue@@QAE@XZ
?GetPath@CFeiInstServer@@SAXIPAD@Z
?GetCount@CFeiInstServer@@SAIXZ
?Attach@CFeiMultiSzRegValue@@QAEHPAUHKEY__@@PBD@Z
??0CFeiMultiSzRegValue@@QAE@PAUHKEY__@@PBD@Z
?create@CFeiRegKey@@QAE_NPBDKKPAU_SECURITY_ATTRIBUTES@@@Z
??1CFeiRegValue@@QAE@XZ
??BCFeiObjectSecurity@@QAEPBDXZ
??BCFeiRegValue@@QAEKXZ
?CheckIE@CFeiSystem@@SAJW4enumCheckIE@1@@Z
?CheckOS@CFeiSystem@@SAJW4enumCheckOS@1@@Z
?CallDistributionService@@YA_NPBDPADAAK@Z
??1CFeiAce@@QAE@XZ
??1CFeiSecurityDescriptor@@QAE@XZ
??1CFeiAcl@@QAE@XZ
??1CFeiSid@@QAE@XZ
??1CFeiInstallService@@QAE@XZ
?GetWinDir@CFeiSystem@@SAPBDXZ
??1CFeiRemoteShare@@UAE@XZ
??1CNTServiceControlManager@@QAE@XZ
??1CNTScmService@@QAE@XZ
?StartServiceA@CFeiInstallService@@QAEJPBD@Z
?Clear@CFeiSid@@IAEXXZ
?Clear@CFeiAcl@@IAEXXZ
?IsDirty@CFeiObjectSecurity@@QBEHXZ
?Edit@CFeiObjectSecurity@@QAEHPBDPAUHWND__@@PAUIFeiObjectSecurityInheritance@@PAX@Z
?SetRegKeyDacl@CFeiSecurityDescriptor@@QBEHPAUHKEY__@@@Z
?SetOwner@CFeiSecurityDescriptor@@QAEHQAX@Z
?SetDacl@CFeiSecurityDescriptor@@QAEHQAU_ACL@@@Z
?Clear@CFeiAce@@IAEXXZ
??0CFeiSecurityDescriptor@@QAE@QAX@Z
??0CFeiAcl@@QAE@QAU_ACL@@@Z
??0CFeiAce@@QAE@PAXKH@Z
?AddAce@CFeiAcl@@QAEHQAX@Z
??4CFeiSid@@QAEAAV0@W4WellKnownSid@0@@Z
??0CFeiSid@@QAE@QAX@Z
?SaveServiceUserCredentials@@YA_NPBD0PAD@Z
??4CFeiRegValue@@QAEAAV0@ABV0@@Z
?AddPath@CFeiInstServer@@SAXPBD@Z
?remove@CFeiRegValue@@QAE_NXZ
?Initialize@CFeiConfigMgr@@QAE_NXZ
??0CFeiRegValue@@QAE@PBD00K@Z
?InstallService@CFeiInstallService@@QAEJPAD0K@Z
?MakeUptodate@CFeiInstallService@@QAEJXZ
??0CFeiInstallService@@QAE@QBD0000@Z
??1CFeiDecryptData@@QAE@XZ
?GetDecryptedData@CFeiDecryptData@@QAEKPAEK@Z
??0CFeiDecryptData@@QAE@PAXK@Z
??1CFeiPrivilege@@QAE@XZ
??0CFeiPrivilege@@QAE@PBDH@Z
?PathIsEqual@CFeiPath@@SAHPBD0@Z
?GetTempDir@CFeiSystem@@SAPBDXZ
?SetCfgDword@CFeiConfigMgr@@QAE_NPBD0K_N@Z
?SetServerPolicy@CFeiInstServer@@SAHPBD0@Z
?RegFind@CRegExp@@QAEHPBD@Z
?RegComp@CRegExp@@QAEPAV1@PBD@Z
??0CRegExp@@QAE@XZ
??1CRegExp@@QAE@XZ
??1iterator@CFeiRegKey@@QAE@XZ
??1iteratorValues@CFeiRegKey@@QAE@XZ
??1CFeiRemoteWksta@@QAE@XZ
?next@iteratorValues@CFeiRegKey@@IAEAAV12@_N@Z
??DiteratorValues@CFeiRegKey@@QAE?AVCFeiRegValue@@XZ
??8iterator@CFeiRegKey@@QAE_NABV01@@Z
?end@CFeiRegKey@@QAE?AViterator@1@XZ
?beginValues@CFeiRegKey@@QAE?AViteratorValues@1@XZ
?MoveFileAfterReboot@CFeiRemoteWksta@@QAEHPBG00@Z
??0CFeiRemoteWksta@@QAE@XZ
?GetWkstaLocalPath@CFeiRemoteWksta@@SAIPBGPAGI@Z
??4CFeiSid@@QAEAAV0@PBD@Z
?FromProcessUser@CFeiSid@@SA?AV1@PAX@Z
?CreateDirectoryRecursive@CFeiTools@@SA_NPBDP6A_NPAG@ZH@Z
??0CFeiObjectSecurity@@QAE@PAUIFeiObjectRights@@@Z
?GetServerPolicy@CFeiInstServer@@SAIPBDPADI@Z
??4CFeiObjectSecurity@@QAEAAV0@PBD@Z
?AccessCheck@CFeiObjectSecurity@@QAEHKPAX@Z
??1CFeiObjectSecurity@@QAE@XZ
?GetPath@CFeiInstServer@@SAXPADH@Z
?IsNT@CFeiSystem@@SAJXZ
?PathIsUNCA@CFeiPath@@SAHPBD@Z
?NetGetUniversalName@CFeiPath@@SAKPBDPADK_N2@Z
?GetComputerNameA@CFeiSystem@@SAPBDXZ
?Clear@CFeiSecurityDescriptor@@IAEXXZ
?SetRegKeyOwner@CFeiSecurityDescriptor@@QBEHPAUHKEY__@@@Z
??4CFeiRegValue@@QAEAAV0@PBD@Z
??4CFeiRegValue@@QAEAAV0@K@Z
?GetItemAt@CFeiMultiSzRegValue@@QBEPBDJ@Z
?GetCount@CFeiMultiSzRegValue@@QBEJXZ
?RegisterNoOpenWithApplication@CFeiTools@@SA_NPBD@Z
?open@CFeiRegKey@@QAE_NPBD0K@Z
?connectTo@CFeiRegKey@@QAE_NPBD@Z
msvfw32
DrawDibOpen
DrawDibDraw
DrawDibClose
Sections
.text Size: 428KB - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 20KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 447KB - Virtual size: 447KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nkh Size: - Virtual size: 1B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE