Static task
static1
Behavioral task
behavioral1
Sample
add8d8e808374dc5170ca96ebeba7411_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
add8d8e808374dc5170ca96ebeba7411_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
add8d8e808374dc5170ca96ebeba7411_JaffaCakes118
-
Size
830KB
-
MD5
add8d8e808374dc5170ca96ebeba7411
-
SHA1
1c33830b47bb8cf37bc07ec5d0d79704fb68d5fb
-
SHA256
b614cccb19b175d95d8a63808044fbb8f87fff4239863b384f064c23054a8704
-
SHA512
4f7971b6cfc14eaebebebcf552ea946daf13b4fe11d7ce29d75aa35d037923d132a01859f4bdeb3890e19ae2dd15ac777b36b8feab5e85222ea36ea16bfa17ee
-
SSDEEP
12288:dFQ1IhyDI2tm8X3B5PrCATpjBDrH6cBWIil2WPXcvFuyrLztHkRJL:dFQ1IhaIQmgx5jJpj5Tm7l2WkN2T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource add8d8e808374dc5170ca96ebeba7411_JaffaCakes118
Files
-
add8d8e808374dc5170ca96ebeba7411_JaffaCakes118.exe windows:5 windows x86 arch:x86
95cb86cc472251dbc090cde30e01e350
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msrating
RatingCustomInit
RatingInit
RatingCustomAddRatingHelper
RatingCustomSetUserOptions
ClickedOnRAT
RatingObtainQuery
RatingAddPropertyPages
ClickedOnPRF
RatingEnable
RatingAccessDeniedDialog2
RatingCustomDeleteCrackedData
RatingCustomSetDefaultBureau
RatingCustomRemoveRatingHelper
RatingCustomAddRatingSystem
VerifySupervisorPassword
RatingSetupUI
RatingEnabledQuery
RatingObtainCancel
RatingCheckUserAccess
ChangeSupervisorPassword
RatingCustomCrackData
RatingAccessDeniedDialog
RatingFreeDetails
ws2_32
WSAStringToAddressA
WSASend
getservbyname
WSALookupServiceBeginW
getpeername
htonl
WSANSPIoctl
WSAEnumProtocolsA
WSAInstallServiceClassA
socket
__WSAFDIsSet
WSAAsyncGetHostByAddr
inet_ntoa
WSAInstallServiceClassW
WSAWaitForMultipleEvents
WSASocketA
WSAAsyncGetProtoByNumber
WSAIoctl
WSAJoinLeaf
getaddrinfo
gethostname
freeaddrinfo
WSApSetPostRoutine
WSAGetServiceClassInfoW
WSAIsBlocking
WSAEventSelect
WSAEnumNameSpaceProvidersW
WSAAsyncGetServByName
shutdown
ioctlsocket
advapi32
CredUnmarshalCredentialA
SystemFunction041
ElfRegisterEventSourceW
RegOpenKeyA
DecryptFileA
TrusteeAccessToObjectW
ElfChangeNotify
CreateTraceInstanceId
QueryServiceLockStatusW
InitiateSystemShutdownA
UnregisterIdleTask
UnregisterTraceGuids
AccessCheckByType
SetAclInformation
GetServiceDisplayNameA
LookupPrivilegeNameW
LsaOpenTrustedDomain
LsaSetTrustedDomainInfoByName
ClearEventLogA
RegQueryInfoKeyA
AccessCheckAndAuditAlarmW
InitiateSystemShutdownExA
LsaLookupPrivilegeDisplayName
SystemFunction005
AccessCheckByTypeResultListAndAuditAlarmByHandleW
IsValidSecurityDescriptor
GetTokenInformation
CryptSetProvParam
SaferRecordEventLogEntry
WmiDevInstToInstanceNameA
msvcirt
?xalloc@ios@@SAHXZ
?get@istream@@QAEAAV1@AAD@Z
??_Gifstream@@UAEPAXI@Z
??_8fstream@@7Bostream@@@
_mtunlock
?setrwbuf@stdiobuf@@QAEHHH@Z
?blen@streambuf@@IBEHXZ
?sh_write@filebuf@@2HB
?gptr@streambuf@@IBEPADXZ
??1ofstream@@UAE@XZ
??5istream@@QAEAAV0@AAH@Z
?str@strstreambuf@@QAEPADXZ
??_Gstdiobuf@@UAEPAXI@Z
??4istream_withassign@@QAEAAVistream@@PAVstreambuf@@@Z
?attach@ifstream@@QAEXH@Z
?epptr@streambuf@@IBEPADXZ
?setp@streambuf@@IAEXPAD0@Z
?get@istream@@QAEAAV1@PACHD@Z
??0streambuf@@IAE@PADH@Z
?snextc@streambuf@@QAEHXZ
??1logic_error@@UAE@XZ
?bad@ios@@QBEHXZ
_mtlock
?cin@@3Vistream_withassign@@A
?endl@@YAAAVostream@@AAV1@@Z
??4stdiobuf@@QAEAAV0@ABV0@@Z
?eatwhite@istream@@QAEXXZ
??5istream@@QAEAAV0@PAVstreambuf@@@Z
?rdbuf@ios@@QBEPAVstreambuf@@XZ
??_Eistream@@UAEPAXI@Z
??_8fstream@@7Bistream@@@
msvcp60
??Gstd@@YA?AV?$complex@O@0@ABV10@ABO@Z
?abs@std@@YANABV?$complex@N@1@@Z
??_F?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ
??9std@@YA_NABV?$complex@N@0@ABN@Z
?thousands_sep@?$numpunct@D@std@@QBEDXZ
??_F?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_Getcat@?$ctype@G@std@@SAIXZ
?imag@?$_Complex_base@O@std@@QBEOXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??_D?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?log10@std@@YA?AV?$complex@N@1@ABV21@@Z
??Dstd@@YA?AV?$complex@O@0@ABV10@ABO@Z
??Pstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?quiet_NaN@?$numeric_limits@K@std@@SAKXZ
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@
??0money_base@std@@QAE@I@Z
wctype
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
??0?$complex@M@std@@QAE@ABV?$complex@O@1@@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
_Denorm
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?do_is@?$ctype@G@std@@MBE_NFG@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0bad_cast@std@@QAE@PBD@Z
?at@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??1?$_Mpunct@G@std@@UAE@XZ
?cosh@std@@YA?AV?$complex@O@1@ABV21@@Z
?pow@std@@YA?AV?$complex@N@1@ABV21@H@Z
?do_max_length@?$codecvt@GDH@std@@MBEHXZ
??_F?$moneypunct@D$00@std@@QAEXXZ
?grouping@?$_Mpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
odbcbcp
dbprtypeW
dbprtypeA
SQLLinkedCatalogsW
LibMain
bcp_batch
bcp_control
bcp_readfmtA
bcp_exec
bcp_initA
bcp_initW
SQLCloseEnumServers
bcp_collen
bcp_writefmtW
SQLGetNextEnumeration
bcp_readfmtW
bcp_bind
bcp_columns
bcp_colfmt
bcp_setcolfmt
bcp_getcolfmt
bcp_writefmtA
bcp_done
SQLLinkedCatalogsA
bcp_moretext
SQLInitEnumServers
bcp_sendrow
SQLLinkedServers
bcp_colptr
msls31
LssbGetNumberDnodesInSubline
LssbGetDurTrailInSubline
LssbGetPlsrunsFromSubline
LsMatchPresSubline
LsGetHihLsimethods
LsCreateSubline
LsSetModWidthPairs
LsFetchAppendToCurrentSubline
LsdnResetObjDim
LsdnGetFormatDepth
LssbGetDupSubline
LsQueryTextCellDetails
LsFinishCurrentSubline
LssbGetObjDimSubline
LsdnSetRigidDup
LsDisplaySubline
LsGetLineDur
LsQueryPointPcpSubline
LsGetRubyLsimethods
LsSqueezeSubline
LsdnFinishRegularAddAdvancePen
LsCompressSubline
LsGetMinDurBreaks
LsExpandSubline
LsdnGetCurTabInfo
wsnmp32
SnmpCreateVbl
SnmpFreeDescriptor
SnmpFreeContext
SnmpSetVb
SnmpGetTimeout
SnmpDuplicateVbl
SnmpCancelMsg
_SnmpSetAgentAddress@4
SnmpListen
SnmpStrToContext
SnmpOpen
SnmpRegister
SnmpSetRetransmitMode
SnmpSendMsg
SnmpStrToEntity
SnmpDuplicatePdu
SnmpGetVendorInfo
SnmpGetTranslateMode
SnmpCountVbl
SnmpFreePdu
SnmpCleanup
SnmpContextToStr
SnmpOidCopy
SnmpEncodeMsg
SnmpSetRetry
SnmpOidToStr
SnmpSetPort
SnmpSetTranslateMode
SnmpOidCompare
SnmpSetTimeout
SnmpGetPduData
SnmpFreeEntity
SnmpRecvMsg
SnmpEntityToStr
SnmpGetRetransmitMode
SnmpSetPduData
SnmpDecodeMsg
SnmpDeleteVb
SnmpStrToOid
SnmpGetLastError
SnmpClose
kernel32
SetLastError
SetFilePointerEx
QueryPerformanceCounter
GetVolumeNameForVolumeMountPointW
CompareFileTime
TlsFree
GetDefaultCommConfigW
SetEvent
SetCommBreak
LoadLibraryA
IsBadHugeWritePtr
VirtualAlloc
EnumTimeFormatsA
GetFileSizeEx
GetTickCount
SetConsoleCP
_lclose
GlobalSize
EnumLanguageGroupLocalesW
VerifyConsoleIoHandle
GetSystemTimeAdjustment
Heap32First
GetQueuedCompletionStatus
GetStartupInfoW
EnumCalendarInfoW
ConvertFiberToThread
FindFirstFileA
GetComputerNameExW
ExpungeConsoleCommandHistoryA
GetProcessHeap
WideCharToMultiByte
lstrcmpW
VerLanguageNameA
Heap32Next
RtlUnwind
GetConsoleInputWaitHandle
WaitNamedPipeA
GetTapeParameters
GetCPInfoExA
untfs
?SetVolumeFlag@NTFS_SA@@QAEEGPAE@Z
?Write@NTFS_BITMAP@@QAEEPAVNTFS_ATTRIBUTE@@PAV1@@Z
ChkdskEx
?Initialize@NTFS_ATTRIBUTE@@QAEEPAVLOG_IO_DP_DRIVE@@KPBXKKPBVWSTRING@@G@Z
??0NTFS_MFT_FILE@@QAE@XZ
?GetNext@NTFS_INDEX_TREE@@QAEPBU_INDEX_ENTRY@@PAKPAEE@Z
??1NTFS_REFLECTED_MASTER_FILE_TABLE@@UAE@XZ
?Initialize@NTFS_FILE_RECORD_SEGMENT@@QAEEXZ
?Initialize@NTFS_ATTRIBUTE_RECORD@@QAEEPAVIO_DP_DRIVE@@PAX@Z
?QueryNumberOfExtents@NTFS_EXTENT_LIST@@QBEKXZ
??1NTFS_MFT_FILE@@UAE@XZ
??1NTFS_UPCASE_TABLE@@UAE@XZ
?WriteRemainingBootCode@NTFS_SA@@QAEEXZ
?GetNextAttributeListEntry@NTFS_ATTRIBUTE_LIST@@QBEPBU_ATTRIBUTE_LIST_ENTRY@@PBU2@@Z
?Write@NTFS_FILE_RECORD_SEGMENT@@UAEEXZ
?QueryFileReference@NTFS_INDEX_TREE@@QAEEKPAXKPAU_MFT_SEGMENT_REFERENCE@@PAE@Z
?MakeNonresident@NTFS_ATTRIBUTE@@UAEEPAVNTFS_BITMAP@@@Z
?QueryName@NTFS_ATTRIBUTE_RECORD@@QBEEPAVWSTRING@@@Z
?IsAttributePresent@NTFS_FILE_RECORD_SEGMENT@@QAEEKPBVWSTRING@@E@Z
?CreateDataAttribute@NTFS_LOG_FILE@@QAEEVBIG_INT@@KPAVNTFS_BITMAP@@@Z
?InsertIntoFile@NTFS_ATTRIBUTE@@UAEEPAVNTFS_FILE_RECORD_SEGMENT@@PAVNTFS_BITMAP@@@Z
?Initialize@NTFS_UPCASE_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
??0NTFS_UPCASE_TABLE@@QAE@XZ
?AddFileNameAttribute@NTFS_FILE_RECORD_SEGMENT@@QAEEPAU_FILE_NAME@@@Z
??0NTFS_ATTRIBUTE_LIST@@QAE@XZ
?IsDosName@NTFS_SA@@SGEPBU_FILE_NAME@@@Z
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 200KB - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 596KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 368B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ