Static task
static1
Behavioral task
behavioral1
Sample
aac189d3663ef47f8c4aaf7e1620e356_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
aac189d3663ef47f8c4aaf7e1620e356_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
aac189d3663ef47f8c4aaf7e1620e356_JaffaCakes118
-
Size
873KB
-
MD5
aac189d3663ef47f8c4aaf7e1620e356
-
SHA1
39e41012c222a46a8c5a65f950fd37cbf993d52f
-
SHA256
addbc55471a99cec854dce6cc0761e27d14d55611456ff813e1525325fbceeaa
-
SHA512
2407750d42050da50bda992839e606a47dbda0de6a60d2de457187778b37ae315803bafd3953830b0c6bca7a7eae1332d6585ea67b1db5332b9e03d64e985163
-
SSDEEP
24576:mkspOG4kg1lilcIIS9+hukP0W1VGW5up3GbPjFOyn:mDpnqTilJtyuG0Wrpk34r86
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aac189d3663ef47f8c4aaf7e1620e356_JaffaCakes118
Files
-
aac189d3663ef47f8c4aaf7e1620e356_JaffaCakes118.exe windows:5 windows x86 arch:x86
234eb1c222c703cab43f84453c39991e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp60
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
??1?$_Mpunct@G@std@@UAE@XZ
??0?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAC@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
?sinh@std@@YA?AV?$complex@O@1@ABV21@@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PAG0PBG1@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?do_thousands_sep@?$numpunct@G@std@@MBEGXZ
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??_F?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Gstd@@YA?AV?$complex@N@0@ABV10@ABN@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIG@Z
?_Getcat@?$_Mpunct@D@std@@SAIXZ
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXPADPBD1@Z
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_N@Z
??1locale@std@@QAE@XZ
??Nstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
_FNan
?round_error@?$numeric_limits@I@std@@SAIXZ
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IABV12@@Z
??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
?pbackfail@strstreambuf@std@@MAEHH@Z
?_Isinf@?$_Ctr@N@std@@SA_NN@Z
??4?$complex@M@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@IIABV?$allocator@G@1@@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPAGII@Z
??_F?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ
??Hstd@@YA?AV?$complex@O@0@ABV10@ABO@Z
?opfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE_NXZ
?ends@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@AAV21@@Z
??1bad_cast@std@@UAE@XZ
?epsilon@?$numeric_limits@N@std@@SANXZ
_FDnorm
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@F@Z
?_Getcat@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIXZ
?negative_sign@?$_Mpunct@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?_Doraise@range_error@std@@MBEXXZ
??1time_base@std@@UAE@XZ
?_Getyes@_Locinfo@std@@QBEPBDXZ
??Bios_base@std@@QBEPAXXZ
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?iword@ios_base@std@@QAEAAJH@Z
?underflow@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@MAEHXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@O@0@@Z
?swap@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXAAV12@@Z
?norm@std@@YAMABV?$complex@M@1@@Z
?close@?$messages@G@std@@QBEXH@Z
??_F?$collate@G@std@@QAEXXZ
??1?$collate@G@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
?_Nomemory@std@@YAXXZ
??0?$messages@D@std@@QAE@ABV_Locinfo@1@I@Z
??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
_FInf
?_Infv@?$_Ctr@O@std@@SAOO@Z
?denorm_min@?$numeric_limits@N@std@@SANXZ
?do_grouping@?$numpunct@G@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?max@?$numeric_limits@I@std@@SAIXZ
??0Init@ios_base@std@@QAE@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??9std@@YA_NABOABV?$complex@O@0@@Z
?flags@ios_base@std@@QAEHH@Z
?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEAAV12@ABV12@@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PBDH@Z
?_Doraise@bad_alloc@std@@MBEXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?pow@std@@YA?AV?$complex@N@1@ABV21@ABN@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
??0_Lockit@std@@QAE@XZ
?max@?$numeric_limits@M@std@@SAMXZ
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
?ws@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@@Z
?round_error@?$numeric_limits@N@std@@SANXZ
??_7?$basic_filebuf@DU?$char_traits@D@std@@@std@@6B@
??Ostd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??Mstd@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?signaling_NaN@?$numeric_limits@C@std@@SACXZ
?stossc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??4?$char_traits@G@std@@QAEAAU01@ABU01@@Z
?infinity@?$numeric_limits@C@std@@SACXZ
??9std@@YA_NABV?$complex@O@0@ABO@Z
??Kstd@@YA?AV?$complex@M@0@ABV10@0@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAG@Z
?id@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Refcnt@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEAAEPBG@Z
?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ
?exceptions@ios_base@std@@QAEXH@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??0?$moneypunct@G$0A@@std@@QAE@I@Z
??1?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
?id@?$messages@G@std@@2V0locale@2@A
??0underflow_error@std@@QAE@ABV01@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??Gstd@@YA?AV?$complex@O@0@ABOABV10@@Z
ntdll
NtCreateSemaphore
ZwEnumerateSystemEnvironmentValuesEx
ZwRequestWaitReplyPort
RtlUnlockHeap
NtAccessCheckAndAuditAlarm
RtlAddAttributeActionToRXact
RtlValidSecurityDescriptor
ZwReplyWaitReceivePort
LdrFindResourceEx_U
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
ZwOpenObjectAuditAlarm
ZwQueryInformationProcess
LdrVerifyImageMatchesChecksum
RtlEnumerateGenericTableWithoutSplayingAvl
RtlUpperString
ZwMapUserPhysicalPagesScatter
RtlUpcaseUnicodeStringToOemString
RtlLargeIntegerSubtract
NtDeleteBootEntry
ZwSetUuidSeed
RtlMultiAppendUnicodeStringBuffer
LdrFlushAlternateResourceModules
NtReleaseKeyedEvent
NtAccessCheckByTypeResultList
strrchr
RtlDowncaseUnicodeString
RtlDeleteRegistryValue
RtlQueryProcessBackTraceInformation
ZwAdjustPrivilegesToken
RtlIpv6AddressToStringW
RtlRunDecodeUnicodeString
ZwOpenKeyedEvent
ZwSetBootEntryOrder
RtlReleaseResource
RtlNewSecurityObject
RtlUnicodeStringToOemSize
RtlFindClearRuns
RtlDnsHostNameToComputerName
RtlDecompressFragment
_memicmp
_lfind
_allrem
RtlAddAccessAllowedObjectAce
RtlCreateTimer
RtlGetNtGlobalFlags
kernel32
HeapValidate
IsProcessInJob
GetCurrencyFormatW
WriteFileGather
GlobalAddAtomA
EnumResourceNamesA
BackupSeek
GetBinaryType
LoadLibraryA
GetVolumePathNamesForVolumeNameA
EnterCriticalSection
Module32First
DeleteCriticalSection
HeapCreate
FindNextFileA
CreateThread
GetNamedPipeHandleStateA
OpenJobObjectW
ExitVDM
GetFirmwareEnvironmentVariableW
SetConsoleOutputCP
GetDiskFreeSpaceExA
GetThreadLocale
EnumUILanguagesW
ExitProcess
GetHandleInformation
SetVolumeLabelA
CreateConsoleScreenBuffer
LeaveCriticalSection
GetCPInfoExW
HeapLock
GetComputerNameExA
HeapReAlloc
LocalShrink
GetVersionExW
ClearCommError
FindVolumeMountPointClose
FreeConsole
CreateMemoryResourceNotification
SetFileAttributesA
VirtualAlloc
GetModuleHandleW
SetVolumeMountPointW
CreateSemaphoreA
CreateActCtxW
dnsapi
DnsRecordTypeForName
Dns_SendEx
DnsStringCopyAllocateEx
Dns_CreateSocket
DnsFree
DnsRemoveRegistrations
DnsApiHeapReset
DnsCreateStringCopy
DnsCopyStringEx
DnsFlushResolverCacheEntry_W
DnsApiSetDebugGlobals
Dns_InitializeMsgRemoteSockaddr
DnsRegisterClusterAddress
Dns_CreateMulticastSocket
DnsGetPrimaryDomainName_A
DnsValidateName_A
DnsQueryConfigDword
DnsUpdateTest_A
DnsNameCopy
DnsExtractRecordsFromMessage_UTF8
Dns_AllocateMsgBuf
DnsUpdate
DnsUtf8ToUnicode
DnsNameCompare_W
DnsQueryConfig
NetInfo_Clean
DnsRecordCompare
DnsDhcpSrvRegisterTerm
DnsCreateStandardDnsNameCopy
DnsExtractRecordsFromMessage_W
DnsApiFree
DnsAsyncRegisterTerm
Dns_SetRecordDatalength
DnsGetLastFailedUpdateInfo
DnsIsStringCountValidForTextType
DnsRecordListFree
NetInfo_Build
Dns_BuildPacket
sqlwoa
_DeleteFile@4
_MessageBox@16
_CallWindowProc@20
_GetDiskFreeSpaceEx@16
_ExtTextOut@32
_trename
_GetModuleFileName@12
newMultiByteFromWideCharSize
_GetWindowTextLength@4
_SetDlgItemText@12
_MoveFile@8
_CharUpper@4
_SendMessage@16
_MAKEINTRESOURCE@4
_CommDlg_OpenSave_GetFilePath@12
_CharLower@4
_GetDlgItemText@16
_FreeEnvironmentStrings@4
_IsDialogMessage@8
_GetClassInfo@12
newMultiByteFromWideChar
_RemoveProp@8
_LoadLibrary@4
_tsystem
_GetComputerName@8
_GetTextExtentPoint32@16
_SetWindowText@8
_LoadBitmap@8
_CreateDialogIndirectParam@20
_StartDoc@8
_SetProp@12
_LoadCursor@8
_GetProp@8
_CommDlg_OpenSave_GetFolderPath@12
_FindResource@12
dbghelp
SymGetSymFromName64
SymGetTypeFromName
SymRegisterFunctionEntryCallback
SymRegisterCallback
WinDbgExtensionDllInit
srcfiles
SymGetLineNext64
FindFileInPath
SymGetSymPrev
SymGetModuleInfo64
ExtensionApiVersion
SymFindFileInPath
SymSetOptions
SymGetTypeInfo
SymGetSymFromAddr64
ImageDirectoryEntryToData
SymSetContext
SymLoadModule
omap
DbgHelpCreateUserDumpW
dh
SymGetModuleInfoW
SymGetSymFromName
SymCleanup
MiniDumpReadDumpStream
SymUnloadModule
advapi32
ConvertStringSDToSDDomainW
RegEnumKeyW
FreeInheritedFromArray
OpenTraceW
CryptGetDefaultProviderA
CryptDuplicateKey
CredProfileLoaded
CloseServiceHandle
LsaSetDomainInformationPolicy
CryptSetProviderExW
SystemFunction019
AddAccessAllowedAce
ImpersonateLoggedOnUser
SaferSetLevelInformation
NotifyChangeEventLog
CredWriteDomainCredentialsA
FlushTraceA
ClearEventLogW
SaferiPopulateDefaultsInRegistry
SystemFunction041
BuildTrusteeWithObjectsAndSidW
SystemFunction018
LsaEnumerateAccountsWithUserRight
RegRestoreKeyA
ControlTraceA
CryptHashData
wow32
WOW32ResolveHandle
CopyDropFilesFrom16
WOWGlobalLockSize16
WOWGetVDMPointerUnfix
W32Dispatch
WOWCallback16Ex
WOWGetVDMPointer
CopyDropFilesFrom32
WOWGlobalAllocLock16
WOWGlobalLock16
WOWGlobalUnlock16
WOWGlobalUnlockFree16
WOWUseMciavi16
WOWDirectedYield16
WOWGlobalAlloc16
WOWCallback16
W32Init
WOWHandle16
WOWGlobalFree16
WOW32DriverCallback
WOWHandle32
WOWFreeMetafile
GetCommHandle
W32HungAppNotifyThread
WOWYield16
WOW32ResolveMemory
WOWGetVDMPointerFix
GetCommShadowMSR
Sections
.text Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 260KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 507KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ