Static task
static1
Behavioral task
behavioral1
Sample
b4c12cf8c99f0edc20253afe19f194c9_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b4c12cf8c99f0edc20253afe19f194c9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b4c12cf8c99f0edc20253afe19f194c9_JaffaCakes118
-
Size
742KB
-
MD5
b4c12cf8c99f0edc20253afe19f194c9
-
SHA1
12be43d61d5bec59b0b46bddff6e3c15881115de
-
SHA256
df5fe086d723bf59192333d5ffb2baeab8306bbd73299335615cdcf63befadab
-
SHA512
a392cfcaedf55b98dbea881ff5f6346ce32591f86e9ba733894f8606f4784a82da69e82728238801e07b5fea899ef6a4ed171d93999cb532947ae8bdff373ec6
-
SSDEEP
12288:GJlaBmHn8+GdLMy3WP2qLMmAWlw0d5GAKwz1egaBLWB3C+LMXddJXosEq:GJ8AHjGdLMhP2qLXAOZGAlz4fJWB3zwr
Malware Config
Signatures
Files
-
b4c12cf8c99f0edc20253afe19f194c9_JaffaCakes118.exe windows:4 windows x86 arch:x86
30964ae41dc9baffbf54b432cd403057
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01/08/1996, 00:00Not After31/12/2020, 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06/08/2003, 00:00Not After05/08/2013, 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:ddCertificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before22/10/2008, 00:00Not After23/11/2010, 23:59SubjectCN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
VirtualAllocEx
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
CreateIcon
MessageBoxA
advapi32
RegCloseKey
oleaut32
VariantClear
version
GetFileVersionInfoA
gdi32
RealizePalette
ole32
OleSaveToStream
comctl32
ImageList_GetImageCount
shell32
Shell_NotifyIconA
quartz
AMGetErrorTextA
wsock32
getservbyname
Exports
Exports
2c�����غ'���M6�iZ�$�9y⧣��|@��������*9aJ"�L/�_3���4J8cJ���3N���Kg/I�cQ[&Cg�X1��@K��^�>�.L����kYuq���%��Y^�%B�^�bǚ'B�81�{�GV�D;�FQi�����'��^A���Μ���s|����'8,-Y\��W�ko�Uf�i� ���J���&_gKQ�1��� �df�,�`g��q�}�p�Rf�&��5�7�~ȂoyݭU�������1�(��?�I�*�"��0�'�ba$��[�*����tṍ�-��]0���4J�XЮ���N�=<P���S���8�(��"��p��\Z����!o�nExM�8��?bq�|��ɋ5�_�ڗ�Z��z��PD���>�'��� �nq1��\�^=��&���mw6|�E�{&��������uI-��5G�t*� 8���C��# T�I�u(�Ņ��U��|0A��E�@��*1ݔ��W��50�n�͖4k��:��]a�: �*��߃�4���`�`F<ʺ�<�tT������1��/M���qc4�H�A�!Z��#aO�}ń��� )>��]�EOvǭ?��\¼J�Yx�����Q��&S������������6����j[�Q��o�<G��pQ&a��=%��6�hY�V>a��s� ��b��%�\g� 3q��v|�L���L7�H~aK���G)�� �{��~��:+O�2�n����qvwT�q�����JnJ��� �������^�Z����Nf���Hc!�m����'S���{<�\-+�A?*>)�i�jg�?وnN� �w�S��7;�fj�uֲa����%M�귐��Q�������2}k3�雬������1ֲr�9K��W�6���y�JC�'�_�g-cnƅ�@��ΐZ�/]cx� Q�U裤bYR�Q;cH�]f�~�gwrh��a{1ֻE<�ZKSM��9=������q���elt�,D��,�ʊ�3``�m3az~��l�rf����p��7(������p8�P|y9_,�E��"�$�qi�f>��"�������~4�x�o���Ty�6ܵd_E{3|��e�="��Vh��h�pI�A�R��5�T�;Z�+�����q^�җ��8m�`�ǁB��W�� ��O�m\/~�1�)�f�1�c���!b�I�헉����e�e��<c{~z�~]|�U�������}^����Q�XA��pA��.L����X6&��]HyC��JYm�I�!}F�m���x�e���9��.Z:-��rU6�(�.��Q�ٝe���Ւ�2+]�����{T��r����N�r͕�$wy}M|�nU���#x��d�x�K9`��E�H���z2��&��G�m,�"�k���h_�xd���gQ:4w��Pq䇇Z������ם|���zlʨ�j����{&̺�95��e�T�|i�OOV$��rcL^R����f�Qz&U4�Ms��7�r�Zi)���g��m�+�UdMf�D�O`�k��{A,RC�L�d-[Ĭ0uoy�>���_���:��KTJ�b�K/%�\��������}Ђ�rhy��ߌnh�Va���=O�m�����i� ;V��O)�cg��dt�[���c���ٴ���ydC����xŕ�y��D`#�y��!q��$(�<��Uf��wQ\�Ѷ�}�>��7.=���i"o/M���2��sh�%��E��TL���-ň����5%�4 ������s��/�oc��<���|(�Ⱦ�y`~�j=<ϝ=�R� �G�Cet����Y�������D���d�Hg���_��Q�L!_w'�<I {�qh6ʾ�c�ʌ�-�� Rd��tʣ�g���^�܉}Hw�J�CLc��̡��5'���I7/�qIK�-��:���nat�sד,]R6��������)�;fu��RU�����o%:��ˊ�D�Y<uw6�{�+���� ��9��t�ny �?�xا��..�[9T�) ����_�G��0�\F����6�>�#v�j��9b-S�N������� #��W������g ���LG�;�W:6�!�(��@З�ls��UD�ҿ��!������������[�t�Q�(��� �I���x��,��+͕�O�z� �]��<�i҂T�9�s\�:�{����o��B&9� k#��%=��� ��M�ji�i�X����� R�C�" )m{�yK_Qڔ0���c1kFΎ���ܣ{q���BZu��j���9�:�^�&7����+;�XD��<65���Ͼ��z��Q�{Ճ��o&c �1�:����@� ��"����@�*�9�{����zUPUs$.u�����`j].~[=9���x�������/DPA^�p�k@:��3*R��/CV�ˆ�pC �_� /��;���eq�V��"�L�&o�Zw�ż��*��P��.�O���A��Ox.�����E����"~l2�"�ߋMoIf�����-�P^pk�L�A���6[VÑ�`��P��N�[!Qޭ��z��#��F�A����#�X�JAn\y+�D����d��+n��w7��Ě�G89 j���=z���4:��"���nqF8��n�E���ǘ��D�Wr{�7��`y8~��(؆Dh��SB��s)����tٵ29�re�~b,��XQ�[`b�O:��n{l��bY���ߋ��D��LE �ˍ����J������\!�@>陎�ɫ��Qǀ� =��PZs�D 7&-�4Y*9 B|p"�����E�zi�,�5�f�5T ��ai���Ӊ�����NQ��t&�ND�O�J�OP� �<���x>[G�/�&>�Q�\9�6�F�d���P�,�����z:����!��� ���:le�� P �סG;���aZO�@ʉ�!�N#cpA������d;�Ɖ����ѵ߸\/ ���Nsy����S�N/=��lF.�����"����{dp4G�TC���v\5��GL�!Y���/���4��+\0Q��"9&�?�m*_6ܗښ���\�#��q�>"��E/6
Sections
.AsPack Size: - Virtual size: 608KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.AsPack Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AsPack Size: - Virtual size: 9KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AsPack Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AsPack Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AsPack Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.AsPack0 Size: - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AsPack1 Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AsPack Size: - Virtual size: 230B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AsPack2 Size: - Virtual size: 318KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AsPack3 Size: 727KB - Virtual size: 726KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ