Static task
static1
Behavioral task
behavioral1
Sample
b9392e81ed38ca9f3071f3f7bc24fea5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b9392e81ed38ca9f3071f3f7bc24fea5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b9392e81ed38ca9f3071f3f7bc24fea5_JaffaCakes118
-
Size
53KB
-
MD5
b9392e81ed38ca9f3071f3f7bc24fea5
-
SHA1
540e4bcd432d81d44089f529d38229c67c705591
-
SHA256
131727eb9d2921bbb429f31c7ecdd0fe040a43c3b394641d510e33cf7d2e66d9
-
SHA512
ca796e82961f396c00ed33ce5c869bc23424bc5170c3e3b00fb393c3c329c27ea3042d23ab68730152624b92acba7f2ea1637b28f2a7097f2ec1cd874ed7cb4f
-
SSDEEP
1536:9s1p5vWhqtvdI8PvT1iwt+4xoP8/lo/5c/LRV0H:9sr1t17S4xoE/lo/5c/LT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9392e81ed38ca9f3071f3f7bc24fea5_JaffaCakes118
Files
-
b9392e81ed38ca9f3071f3f7bc24fea5_JaffaCakes118.exe windows:5 windows x86 arch:x86
ec173286e46d4da94dfebadad79eabe3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
sqlunirl
AbortSystemShutdown_
_WriteProfileSection_@8
_GetMenuItemInfo_@16
_GetProfileString_@20
_CreateMailslot_@16
_LookupPrivilegeDisplayName_@20
_GetCharacterPlacement_@24
_CreateMutex_@12
__lwrite_@12
_SHGetFileInfo_@20
_EnumServicesStatus_@32
_CreateColorSpace_@4
_AccessCheckAndAuditAlarm_@44
_RegQueryValueEx_@24
_GetEnvironmentVariable_@12
newMultiByteFromWideChar
_RemoveProp@8
_CreateMDIWindow_@40
_EnumFontFamilies_@16
_CreatePropertySheetPage_@4
_ShellAbout_@16
_OpenWaitableTimer_@12
_GetEnvironmentStrings_@4
_LoadBitmap@8
_RegSetValueEx_@24
_ShellExecuteEx_@4
_MAKEINTRESOURCE@4
kernel32
OpenWaitableTimerW
GetModuleHandleExA
ReadConsoleOutputAttribute
LoadLibraryA
ReadFileScatter
ReadConsoleInputExW
SetProcessShutdownParameters
SetFilePointerEx
LocalAlloc
SetConsoleActiveScreenBuffer
DeleteTimerQueueEx
ReplaceFileA
GetCurrentThread
SetEvent
GetSystemDefaultLCID
UnlockFileEx
Beep
CreateActCtxW
BackupSeek
BuildCommDCBA
FreeEnvironmentStringsW
FindActCtxSectionStringW
CreateConsoleScreenBuffer
GetEnvironmentStringsW
SetTimeZoneInformation
FindFirstFileA
QueryPerformanceCounter
VirtualAlloc
RequestWakeupLatency
HeapQueryInformation
InitializeCriticalSectionAndSpinCount
DebugSetProcessKillOnExit
lstrcmp
WritePrivateProfileStringW
GlobalFindAtomA
FlushInstructionCache
SetVolumeMountPointW
LocalFileTimeToFileTime
GetDateFormatA
VirtualUnlock
GetCPInfoExW
msvcrt
_lseek
__CxxDetectRethrow
_searchenv
_ungetwch
iswlower
_stati64
_fileno
_wexecv
_ismbcl0
__lc_codepage
__uncaught_exception
fmod
fwscanf
_wcsicmp
_CxxThrowException
_mbbtombc
__RTDynamicCast
fputc
_initterm
_copysign
?_set_new_mode@@YAHH@Z
??0__non_rtti_object@@QAE@ABV0@@Z
_wchdir
_mbsncpy
_ftol
_mbsstr
_itoa
_aligned_free
??1type_info@@UAE@XZ
setbuf
_snwprintf
wscanf
_acmdln
gmtime
??0bad_typeid@@QAE@PBD@Z
strtok
_lseeki64
_spawnlp
_daylight
ldexp
_mbcjmstojis
??_U@YAPAXI@Z
msdart
?FindKey@CLKRHashTable@@QBE?AW4LK_RETCODE@@KPAPBX@Z
?DeleteRecord@CLKRHashTable@@QAE?AW4LK_RETCODE@@PBX@Z
?InsertHead@CDoubleList@@QAEXQAVCListEntry@@@Z
?ReadLock@CReaderWriterLock3@@QAEXXZ
?Apply@CLKRHashTable@@QAEKP6G?AW4LK_ACTION@@PBXPAX@Z1W4LK_LOCKTYPE@@@Z
?GetSpinCount@CReaderWriterLock2@@QBEGXZ
?_RemoveThisFromGlobalList@CLKRLinearHashTable@@AAEXXZ
?GetStatistics@CLKRHashTable@@QBE?AVCLKRHashTableStats@@XZ
?Lock@CLockedDoubleList@@QAEXXZ
MpHeapDestroy
??1CFakeLock@@QAE@XZ
?IsReadUnlocked@CLKRLinearHashTable@@QBE_NXZ
?IsWriteUnlocked@CSpinLock@@QBE_NXZ
?_LockSpin@CSpinLock@@AAEXXZ
??4CMdVersionInfo@@QAEAAV0@ABV0@@Z
?GetDefaultSpinCount@CCritSec@@SGGXZ
MpHeapFree
?NumSubTables@CLKRHashTable@@QBEHXZ
?ReadOrWriteUnlock@CSpinLock@@QAEX_N@Z
??4CLockedDoubleList@@QAEAAV0@ABV0@@Z
?IsWriteUnlocked@CCritSec@@QBE_NXZ
?IsWin9x@CMdVersionInfo@@SAHXZ
?IsWriteLocked@CReaderWriterLock@@QBE_NXZ
?ConvertExclusiveToShared@CReaderWriterLock3@@QAEXXZ
?WriteLock@CReaderWriterLock2@@QAEXXZ
?GetSpinCount@CCritSec@@QBEGXZ
?MaxSize@CLKRHashTable@@QBEKXZ
?FindRecord@CLKRHashTable@@QBE?AW4LK_RETCODE@@PBX@Z
?ReadLock@CCritSec@@QAEXXZ
?DeleteIf@CLKRHashTable@@QAEKP6G?AW4LK_PREDICATE@@PBXPAX@Z1@Z
?WriteUnlock@CSpinLock@@QAEXXZ
MpHeapAlloc
?ReadOrWriteUnlock@CCritSec@@QAEX_N@Z
?ValidSignature@CLKRHashTable@@QBE_NXZ
?sm_lpOSVERSIONINFO@CMdVersionInfo@@0PAU_OSVERSIONINFOW@@A
?WriteUnlock@CCritSec@@QAEXXZ
?_CmpExch@CReaderWriterLock2@@AAE_NJJ@Z
?SetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SGXN@Z
?IsWinNT@CMdVersionInfo@@SAHXZ
??4CCritSec@@QAEAAV0@ABV0@@Z
?SetDefaultSpinAdjustmentFactor@CReaderWriterLock2@@SGXN@Z
adsldpc
ADsWriteClassDefinition
SchemaIsClassAContainer
GetLDAPTypeName
?SetFSlashDisabler@CLexer@@QAEXH@Z
BuildLDAPPathFromADsPath
SortAndRemoveDuplicateOIDs
ADSIModifyRdn
LdapGetSubSchemaSubEntryPath
BuildADsParentPath
ADsCreateDSObjectExt
ADsDecodeBinaryData
ADsCreateDSObject
LdapNextEntry
??1CLexer@@QAE@XZ
LdapTypeFreeLdapObjects
FindSearchTableIndex
LdapModifyExtS
ADSICloseDSObject
LdapReadAttributeFast
LdapSearchST
AdsTypeToLdapTypeCopyConstruct
LdapControlFree
AdsTypeToLdapTypeCopyDNWithString
LdapGetDn
?GetNextToken@CLexer@@QAEJPAGPAK@Z
LdapGetValues
LdapSearchInitPage
ADsCloseSearchHandle
LdapSearchAbandonPage
LdapValueFree
SchemaGetPropertyInfo
BuildADsPathFromLDAPPath2
FreeADsMem
ADSIFreeColumn
AdsTypeToLdapTypeCopyTime
GetDefaultServer
?SetAtDisabler@CLexer@@QAEXH@Z
GetDomainDNSNameForDomain
LdapTypeToAdsTypeCopyConstruct
GetSyntaxOfAttribute
ADsGetFirstRow
LdapModifyS
ADSIGetColumn
atmlib
ATMGetFontPathsW
ATMEnumMMFontsA
ATMAddFontExW
ATMInstallSubstFontW
ATMEnumFonts
ATMGetPostScriptNameW
ATMAddFontA
ATMGetBuildStrW
ATMClient
ATMGetFontInfoA
ATMGetFontInfo
ATMInstallSubstFontA
ATMGetVersionEx
ATMFontAvailableW
ATMXYShowText
ATMGetPostScriptName
ATMGetBuildStrA
ATMFontSelected
ATMGetFontBBox
ATMGetNtmFieldsA
ATMBeginFontChange
ATMFontAvailable
ATMGetVersionExW
ATMEnumFontsW
ATMMakePSS
ATMMakePFM
ATMGetFontPathsA
ATMFontStatus
ATMAddFontExA
ATMFontStatusA
ATMRemoveFontW
ATMGetOutlineW
ATMBBoxBaseXYShowTextW
dnsapi
DnsFlushResolverCacheEntry_UTF8
CombineRecordsInBlob
DnsReleaseContextHandle
DnsWriteQuestionToBuffer_W
DnsReplaceRecordSetA
Dns_ReadPacketName
DnsApiAlloc
DnsNameCompareEx_A
Dns_BuildPacket
Dns_GetRandomXid
Dns_CreateMulticastSocket
DnsGetDomainName
DnsValidateName_A
QueryDirectEx
DnsIpv6AddressToString
DnsSetConfigDword
DnsRecordTypeForName
NetInfo_Copy
Dns_ParsePacketRecord
DnsNotifyResolverClusterIp
DnsRemoveRegistrations
DnsGetBufferLengthForStringCopy
Dns_OpenTcpConnectionAndSend
Dns_AllocateMsgBuf
Dns_SkipPacketName
DnsRecordBuild_UTF8
user32
PostQuitMessage
RegisterClassW
DefWindowProcW
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ