Static task
static1
Behavioral task
behavioral1
Sample
a8d3456cc775ed90c85206b082a93322_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a8d3456cc775ed90c85206b082a93322_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a8d3456cc775ed90c85206b082a93322_JaffaCakes118
-
Size
827KB
-
MD5
a8d3456cc775ed90c85206b082a93322
-
SHA1
3af94c9ad62a41c39c5ceb5162f2799b1d1ddee2
-
SHA256
d9bc8547a10937301f32d7b15a023550074cf197bd922b96a857965a69f28161
-
SHA512
4b82cfdad1a8b90870e68b3d21f65bc68f063c75c388711faaf709e2c00b8f09a08951ae236aee382747503183548a479f35a201a4c0762f3a7b5c3b59e43c8c
-
SSDEEP
12288:I6sMbmL98NJ/ZL0en26Z2XBHZf8LA71XKYtLH4r72f1WFistTX9cgfhe4:I6lA8NJxQ62HXBW05XKuH4rqsnhhe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8d3456cc775ed90c85206b082a93322_JaffaCakes118
Files
-
a8d3456cc775ed90c85206b082a93322_JaffaCakes118.exe windows:5 windows x86 arch:x86
e87debba0f48a5cd33540f0765495688
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp60
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?_Doraise@bad_cast@std@@MBEXXZ
??_7?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_first_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?do_is@?$ctype@G@std@@MBEPBGPBG0PAF@Z
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGHG@Z
?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z
?overflow@strstreambuf@std@@MAEHH@Z
??1?$moneypunct@D$0A@@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGH@Z
??8locale@std@@QBE_NABV01@@Z
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z
??0?$moneypunct@G$00@std@@QAE@I@Z
?_Init@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
??1?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
?to_int_type@?$char_traits@D@std@@SAHABD@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIABV12@@Z
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?do_encoding@?$codecvt@GDH@std@@MBEHXZ
??_F?$collate@D@std@@QAEXXZ
?epsilon@?$numeric_limits@I@std@@SAIXZ
??X?$_Complex_base@N@std@@QAEAAV01@ABN@Z
?real@std@@YANABV?$complex@N@1@@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@ABV01@@Z
??4?$numeric_limits@G@std@@QAEAAV01@ABV01@@Z
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??Pstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??_F?$complex@O@std@@QAEXXZ
?setf@ios_base@std@@QAEHHH@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?sin@?$_Ctr@O@std@@SAOO@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
??4overflow_error@std@@QAEAAV01@ABV01@@Z
?_Xlen@std@@YAXXZ
?_Init@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXPBDIH@Z
??9std@@YA_NABV?$complex@N@0@ABN@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?epsilon@?$numeric_limits@J@std@@SAJXZ
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?cosh@std@@YA?AV?$complex@M@1@ABV21@@Z
?_Getmonths@_Locinfo@std@@QBEPBDXZ
?_Getcat@?$ctype@D@std@@SAIXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_F?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ
?do_decimal_point@?$_Mpunct@G@std@@MBEGXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@IIABV?$allocator@G@1@@Z
??0?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??_7logic_error@std@@6B@
??Kstd@@YA?AV?$complex@N@0@ABV10@0@Z
??8std@@YA_NABV?$complex@N@0@ABN@Z
?intl@?$moneypunct@D$00@std@@2_NB
?real@?$_Complex_base@N@std@@QAENABN@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@G@Z
?pbackfail@strstreambuf@std@@MAEHH@Z
??_7?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??_F?$moneypunct@D$00@std@@QAEXXZ
?pbackfail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z
?_Init@?$collate@D@std@@IAEXABV_Locinfo@2@@Z
??Kstd@@YA?AV?$complex@N@0@ABNABV10@@Z
user32
GetMenuItemID
wvsprintfA
GetWindowRect
InSendMessage
UserLpkPSMTextOut
CascadeWindows
SwapMouseButton
GetScrollPos
CascadeChildWindows
GetWindowLongW
DragObject
GetWindowInfo
PaintDesktop
DdeEnableCallback
EnumDesktopsA
RealGetWindowClassA
LoadCursorW
UnhookWinEvent
LookupIconIdFromDirectory
EndTask
GetGuiResources
InsertMenuItemW
CharUpperW
DrawAnimatedRects
EnumDisplayDevicesW
shlwapi
StrCmpNIA
StrRChrA
PathUnmakeSystemFolderW
StrCatBuffA
PathIsPrefixW
SHCreateShellPalette
SHDeleteKeyW
PathCompactPathA
PathCreateFromUrlW
SHEnumKeyExA
PathUnquoteSpacesW
UrlIsA
StrCpyNW
PathRelativePathToA
SHDeleteKeyA
PathMakePrettyA
SHRegQueryInfoUSKeyA
SHRegGetBoolUSValueW
PathMakePrettyW
SHGetValueW
PathStripToRootA
PathFindFileNameA
DllGetVersion
PathFindExtensionW
PathSearchAndQualifyW
UrlIsOpaqueW
advapi32
RegDeleteValueA
SystemFunction011
CredDeleteW
LookupSecurityDescriptorPartsA
SystemFunction006
ControlTraceW
AccessCheckByTypeResultListAndAuditAlarmA
GetSecurityDescriptorRMControl
MakeAbsoluteSD2
LsaRemovePrivilegesFromAccount
FreeEncryptedFileKeyInfo
SaferComputeTokenFromLevel
LsaSetQuotasForAccount
LsaSetSecret
GetSecurityDescriptorSacl
EnumDependentServicesW
FreeEncryptionCertificateHashList
SaferiSearchMatchingHashRules
SetEntriesInAclA
RegSaveKeyExW
LsaOpenTrustedDomain
RegSetKeySecurity
WmiFileHandleToInstanceNameA
CreatePrivateObjectSecurity
CryptGenRandom
SetSecurityDescriptorRMControl
ElfOpenEventLogA
RegSetValueExW
CredReadA
ElfReportEventW
RegDeleteValueW
RegOpenKeyExA
A_SHAFinal
ElfOldestRecord
LookupAccountSidW
LockServiceDatabase
GetCurrentHwProfileA
ConvertSecurityDescriptorToAccessA
kernel32
GetCurrentProcessId
GetNumaNodeProcessorMask
GetStartupInfoA
EnumSystemLanguageGroupsA
SetComputerNameA
LZStart
VirtualProtectEx
HeapReAlloc
GetCurrentThreadId
BuildCommDCBAndTimeoutsA
lstrlenW
LoadLibraryA
Process32First
EnumSystemLanguageGroupsW
GetVolumePathNameW
RemoveDirectoryA
RegisterWaitForSingleObjectEx
GetProcessHeaps
PeekConsoleInputA
RequestDeviceWakeup
GetNumaProcessorNode
GetProfileStringW
SetLocaleInfoA
SetFilePointerEx
ClearCommBreak
ReleaseActCtx
EnumSystemLocalesW
GetProcessHeap
Process32NextW
RegisterConsoleOS2
CreateHardLinkA
GetConsoleAliasesW
GetSystemTimeAsFileTime
GlobalUnWire
VirtualAlloc
GetPrivateProfileSectionW
GetBinaryTypeW
QueryPerformanceFrequency
LocalFileTimeToFileTime
TlsFree
SetFileShortNameA
mprddm
DDMAdminPortReset
RasAcctProviderInterimAccounting
RasAuthProviderTerminate
IfObjectNotifyOfReachabilityChange
DDMSendUserMessage
IfObjectInitiatePersistentConnections
RasAuthProviderInitialize
RasAuthProviderFreeAttributes
DDMServiceInitialize
DDMAdminPortGetInfo
RasAcctProviderInitialize
DDMAdminConnectionClearStats
RasAcctProviderStartAccounting
DDMAdminConnectionEnum
DDMAdminPortEnum
IfObjectSetDialoutHoursRestriction
DDMAdminInterfaceDisconnect
DDMAdminInterfaceConnect
DDMTransportCreate
DDMDisconnectInterface
RasAuthConfigChangeNotification
RasAcctProviderFreeAttributes
DDMServicePostListens
RasAcctProviderStopAccounting
DDMAdminPortClearStats
IfObjectLoadPhonebookInfo
DDMRegisterConnectionNotification
DDMAdminPortDisconnect
DDMConnectInterface
DDMGetIdentityAttributes
RasAcctProviderTerminate
RasAuthProviderAuthenticateUser
DDMAdminServerGetInfo
DDMAdminConnectionGetInfo
RasAcctConfigChangeNotification
secur32
SetContextAttributesW
ImportSecurityContextA
MakeSignature
InitializeSecurityContextW
SecpTranslateNameEx
QuerySecurityContextToken
DecryptMessage
LsaUnregisterPolicyChangeNotification
CompleteAuthToken
SaslGetProfilePackageW
EnumerateSecurityPackagesA
QueryContextAttributesW
GetComputerObjectNameA
SecpFreeMemory
TranslateNameW
QueryCredentialsAttributesA
GetComputerObjectNameW
AddSecurityPackageW
ImportSecurityContextW
SecpTranslateName
LsaCallAuthenticationPackage
CredMarshalTargetInfo
GetUserNameExW
RevertSecurityContext
EnumerateSecurityPackagesW
SaslGetProfilePackageA
InitializeSecurityContextA
AddCredentialsW
FreeContextBuffer
InitSecurityInterfaceA
CredUnmarshalTargetInfo
DeleteSecurityContext
InitSecurityInterfaceW
expsrv
__vbaRsetFixstr
__vbaStrVarCopy
rtcIPMT
__vbaRecAnsiToUni
__vbaVarTextTstGt
rtcVarBstrFromByte
__vbaGenerateBoundsError
__vbaDateR8
__vbaDerefAry1
__vbaUbound
__vbaR4Cy
rtcEnvironBstr
__vbaAryVarVarg
__vbaVarAdd
__vbaVarAbs
__vbaInStr
TipGetAddressOfPredeclaredInstance
__vbaStrDate
rtcJoin
rtcMacId
_adj_fptan
rtcPMT
__vbaGosubFree
_adj_fdiv_m16i
BASIC_DISPINTERFACE_GetTypeInfo
__vbaCopyBytesZero
__vbaR4Str
rtcGetHostLCID
rtcLeftCharVar
__vbaFPFix
__vbaStrI4
rtcEnvironVar
__vbaExitEachAry
PutMem2
_adj_fdiv_r
__vbaVarCopy
__vbaUI1Cy
GetMem2
rtcGetDateBstr
rtcFreeFile
__vbaCyFix
wintrust
WTHelperGetKnownUsages
WintrustCertificateTrust
mssip32DllUnregisterServer
OpenPersonalTrustDBDialog
DriverFinalPolicy
GenericChainCertificateTrust
SoftpubCleanup
TrustFindIssuerCertificate
WintrustAddDefaultForUsage
DllRegisterServer
DriverCleanupPolicy
CryptCATAdminResolveCatalogPath
WVTAsn1SpcPeImageDataEncode
DriverInitializePolicy
WTHelperGetProvPrivateDataFromChain
mssip32DllRegisterServer
CryptCATAdminAcquireContext
CryptCATPutAttrInfo
SoftpubLoadDefUsageCallData
CryptSIPRemoveSignedDataMsg
WintrustGetDefaultForUsage
SoftpubAuthenticode
CryptCATAdminRemoveCatalog
TrustFreeDecode
WVTAsn1SpcSpOpusInfoDecode
SoftpubDumpStructure
CryptCATCDFEnumMembers
CryptSIPGetRegWorkingFlags
CryptCATPersistStore
WVTAsn1SpcStatementTypeDecode
OpenPersonalTrustDBDialogEx
mscat32DllRegisterServer
WintrustAddActionID
WVTAsn1SpcMinimalCriteriaInfoEncode
WTHelperProvDataFromStateData
WVTAsn1CatMemberInfoEncode
WintrustSetRegPolicyFlags
WVTAsn1SpcPeImageDataDecode
SoftpubDllUnregisterServer
CryptCATAdminPauseServiceForBackup
Sections
.text Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 620KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ