Static task
static1
Behavioral task
behavioral1
Sample
bd6edc76c4ee1a7c4cf8466e6b7eb453_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bd6edc76c4ee1a7c4cf8466e6b7eb453_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bd6edc76c4ee1a7c4cf8466e6b7eb453_JaffaCakes118
-
Size
247KB
-
MD5
bd6edc76c4ee1a7c4cf8466e6b7eb453
-
SHA1
e425f0ec5bfba689bfd1667a1cd9c819dddd2955
-
SHA256
9c07dc01be05dc842463d0c5858f3b830b69358242aec952da6832fcfac98d06
-
SHA512
dbf2f492b56eb1953618bbf8726159b07d1ba88ffa84767a99fce1d2ea5e2ca7fe36b0fd43bd934458acbcbcc15591f68fb8ca67e847cafe33901e525cde86e0
-
SSDEEP
3072:o7n72bqv1JMUli1AIeNB8WdruRfyFefI+KhhKYuoL441UuIgAfoju7nyQA8ycMZ7:pqv1gAI48gqRZw+KhJd4EUpw55ZZx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd6edc76c4ee1a7c4cf8466e6b7eb453_JaffaCakes118
Files
-
bd6edc76c4ee1a7c4cf8466e6b7eb453_JaffaCakes118.exe windows:5 windows x86 arch:x86
7e7977d348b1bdd306c1861abcee26eb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
TerminateThread
WaitForSingleObject
CreateThread
GetFileAttributesExA
ExpandEnvironmentStringsA
lstrlenA
lstrcatA
lstrcpyA
GetLastError
CreateMutexA
MoveFileA
RemoveDirectoryA
DeleteFileA
CreateDirectoryA
GetTempPathA
GetCommandLineA
GetModuleFileNameA
Sleep
GetLocalTime
GetTickCount
ReadFile
GetProcessHeap
SetEndOfFile
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetFilePointer
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
HeapSize
HeapAlloc
FlushFileBuffers
WriteFile
VirtualFree
HeapFree
HeapCreate
HeapDestroy
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
ExitProcess
OutputDebugStringW
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetConsoleMode
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetStartupInfoA
HeapValidate
IsBadReadPtr
GetProcAddress
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
WideCharToMultiByte
GetConsoleCP
user32
wsprintfA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyA
ole32
CoInitialize
GetClassFile
shell32
ShellExecuteA
shlwapi
PathIsDirectoryA
PathFileExistsA
PathFindFileNameA
PathRemoveBlanksA
PathGetArgsA
gdi32
GetGraphicsMode
GetBkColor
AbortPath
ModifyWorldTransform
GetRandomRgn
StartDocW
GetFontUnicodeRanges
DeleteEnhMetaFile
GetCharWidthW
ArcTo
GetFontLanguageInfo
RectInRegion
GetTextExtentPointI
GetRasterizerCaps
GdiAlphaBlend
GetCharacterPlacementA
PlayEnhMetaFile
DeleteMetaFile
SelectClipPath
PatBlt
ExtSelectClipRgn
PolyBezierTo
GetDeviceGammaRamp
GetCharWidthFloatA
OffsetClipRgn
GetCharABCWidthsFloatA
CreateDiscardableBitmap
GetCharWidth32A
GetBoundsRect
GetEnhMetaFilePixelFormat
AddFontResourceExW
Arc
CreateCompatibleBitmap
GetCharABCWidthsA
SetDeviceGammaRamp
GetTextExtentExPointI
AnimatePalette
GetGlyphIndicesW
SetMetaFileBitsEx
GetWindowExtEx
GetTextFaceW
SetColorSpace
AddFontResourceW
GetOutlineTextMetricsW
CreateBitmap
SetDIBitsToDevice
TextOutW
BeginPath
EqualRgn
SetBkMode
LineTo
SelectClipRgn
GetTextMetricsW
SetBrushOrgEx
CreateColorSpaceW
GetEnhMetaFilePaletteEntries
GetTextCharacterExtra
CreateDIBPatternBrushPt
Pie
CreateICA
EnumEnhMetaFile
CopyEnhMetaFileW
GetEnhMetaFileHeader
RoundRect
CloseMetaFile
GetEnhMetaFileDescriptionA
UpdateColors
SetViewportExtEx
CreatePolyPolygonRgn
GetGlyphOutlineA
GetViewportOrgEx
SetWinMetaFileBits
EndPath
StretchDIBits
PolyBezier
GetDIBits
EnumFontFamiliesA
TextOutA
SetDCBrushColor
PlayMetaFile
GetTextAlign
IntersectClipRect
CreateFontW
SetTextCharacterExtra
CreateEllipticRgnIndirect
GetLogColorSpaceA
CreateDCW
CombineTransform
SaveDC
PolyPolygon
GetEnhMetaFileBits
GetKerningPairsA
SelectObject
GetPaletteEntries
GetICMProfileW
PlgBlt
CloseEnhMetaFile
CreateDIBPatternBrush
UnrealizeObject
Ellipse
SetMapMode
GetNearestPaletteIndex
GetPath
GetMetaRgn
GetCharWidthA
ScaleWindowExtEx
Escape
AngleArc
PolyTextOutA
ResetDCW
ExtEscape
CancelDC
MaskBlt
CreateDIBSection
GetMetaFileBitsEx
PolylineTo
SetPixelFormat
GetCharABCWidthsFloatW
ExtTextOutA
SetROP2
GdiSetBatchLimit
GetLayout
Polyline
CreateEnhMetaFileA
CreateDCA
SetWindowOrgEx
GdiTransparentBlt
LineDDA
AddFontResourceA
DescribePixelFormat
GetCurrentObject
GetAspectRatioFilterEx
CreateBrushIndirect
GetDCBrushColor
SetMetaRgn
SetBoundsRect
GetTextMetricsA
GetWinMetaFileBits
PolyDraw
CreateSolidBrush
FlattenPath
SetTextJustification
GetStockObject
BitBlt
GetTextExtentPointA
GetOutlineTextMetricsA
SwapBuffers
ExtCreatePen
GetBitmapBits
GetMapMode
EnumFontFamiliesExW
GetMiterLimit
AddFontMemResourceEx
CopyEnhMetaFileA
GetFontData
EndPage
PolyTextOutW
FrameRgn
GetKerningPairsW
CreateFontA
FloodFill
PlayEnhMetaFileRecord
CheckColorsInGamut
OffsetRgn
CreateHalftonePalette
GetEnhMetaFileA
SetAbortProc
CreateScalableFontResourceW
CreateScalableFontResourceA
GetCharWidthFloatW
SetDIBColorTable
CloseFigure
SetLayout
CreateMetaFileA
CreatePenIndirect
WidenPath
GetICMProfileA
RestoreDC
GetDIBColorTable
SetArcDirection
PathToRegion
RemoveFontMemResourceEx
CopyMetaFileW
SetMapperFlags
ws2_32
send
closesocket
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
gethostbyname
WSAStartup
recv
netapi32
Netbios
crypt32
CryptVerifyMessageHash
CryptBinaryToStringW
CryptMsgOpenToDecode
CryptMsgSignCTL
CryptMsgEncodeAndSignCTL
CryptEncodeObjectEx
CertGetEnhancedKeyUsage
CryptGetKeyIdentifierProperty
CertOIDToAlgId
CryptCreateKeyIdentifierFromCSP
CryptVerifyCertificateSignatureEx
CertRemoveStoreFromCollection
CryptUnprotectData
CryptVerifyMessageSignatureWithKey
CertControlStore
CryptMsgVerifyCountersignatureEncodedEx
CertAddSerializedElementToStore
CertSaveStore
CertEnumPhysicalStore
CertAddStoreToCollection
CertCreateSelfSignCertificate
CertEnumCertificateContextProperties
PFXExportCertStoreEx
CertStrToNameW
CertSetCRLContextProperty
CertEnumSystemStore
CryptMemAlloc
CryptProtectData
CryptExportPKCS8
CertStrToNameA
CryptVerifyCertificateSignature
CertGetPublicKeyLength
CryptEnumOIDFunction
CertCreateContext
CryptHashPublicKeyInfo
CryptFormatObject
CryptGetOIDFunctionAddress
CryptInstallOIDFunctionAddress
CryptFindLocalizedName
CryptVerifyDetachedMessageSignature
CryptImportPublicKeyInfo
CertVerifyTimeValidity
CertGetStoreProperty
CryptInitOIDFunctionSet
CryptCloseAsyncHandle
CertDuplicateCertificateContext
CryptMsgDuplicate
CertSetCertificateContextProperty
CertVerifySubjectCertificateContext
CertAddEncodedCertificateToStore
CryptRegisterDefaultOIDFunction
CryptUnregisterDefaultOIDFunction
CertRDNValueToStrA
CertFindCertificateInCRL
CertGetCertificateChain
CertFreeCertificateChain
CertCompareCertificateName
PFXVerifyPassword
CryptHashToBeSigned
CertResyncCertificateChainEngine
CertRemoveEnhancedKeyUsageIdentifier
CryptCreateAsyncHandle
CryptSignMessage
CryptFreeOIDFunctionAddress
CertEnumSystemStoreLocation
CryptDecryptMessage
CryptMemRealloc
CertNameToStrA
CertCompareCertificate
CertFreeCTLContext
CryptDecodeObject
PFXIsPFXBlob
CryptSetAsyncParam
CertAddCTLContextToStore
CryptSignAndEncryptMessage
CertFindCTLInStore
CertVerifyCRLRevocation
CertGetValidUsages
CryptSignMessageWithKey
CertDeleteCertificateFromStore
CertGetIntendedKeyUsage
CryptSetKeyIdentifierProperty
CertAddCertificateContextToStore
CertAddCTLLinkToStore
CryptImportPublicKeyInfoEx
CryptFindOIDInfo
CertRegisterPhysicalStore
CryptMsgCountersignEncoded
CertDuplicateCertificateChain
CryptStringToBinaryA
CryptSignAndEncodeCertificate
CertOpenSystemStoreA
CertAddCertificateLinkToStore
CertRDNValueToStrW
CryptEncryptMessage
CertAlgIdToOID
CertAddCRLLinkToStore
CertNameToStrW
CertFindCertificateInStore
CertDeleteCRLFromStore
CertFindSubjectInSortedCTL
CertFindSubjectInCTL
CryptVerifyDetachedMessageHash
CryptMsgUpdate
CertIsRDNAttrsInCertificateName
CertSetCTLContextProperty
CertGetCRLFromStore
CertCloseStore
CertAddEncodedCertificateToSystemStoreA
CertGetCRLContextProperty
CertGetSubjectCertificateFromStore
CertVerifyCTLUsage
CryptEnumKeyIdentifierProperties
CryptRegisterOIDInfo
CertSerializeCertificateStoreElement
CryptEnumOIDInfo
CryptGetDefaultOIDDllList
CertSerializeCRLStoreElement
CertEnumCTLContextProperties
CertVerifyCRLTimeValidity
CertGetCertificateContextProperty
CertCreateCertificateChainEngine
CertEnumCRLContextProperties
CertDuplicateCTLContext
CertFindCRLInStore
CryptSignCertificate
CryptUnregisterOIDFunction
imm32
ImmGetConversionListA
ImmGetCandidateListCountW
ImmGetOpenStatus
ImmGetDescriptionW
ImmGetImeMenuItemsA
ImmGetImeMenuItemsW
ImmGetCompositionStringW
ImmConfigureIMEW
ImmNotifyIME
ImmGetCompositionWindow
ImmGetContext
ImmSetCompositionStringA
ImmAssociateContextEx
ImmEnumRegisterWordW
ImmDestroyContext
ImmRegisterWordA
ImmGetCandidateListA
ImmSetCompositionFontA
ImmGetCandidateWindow
ImmEscapeW
ImmEnumRegisterWordA
ImmSetCompositionStringW
ImmConfigureIMEA
ImmDisableIME
ImmCreateContext
ImmSetConversionStatus
ImmIsIME
ImmGetDefaultIMEWnd
ImmReleaseContext
ImmEscapeA
iphlpapi
GetBestInterfaceEx
GetTcpStatistics
GetIpAddrTable
GetRTTAndHopCount
RestoreMediaSense
SetIpStatistics
GetAdaptersInfo
SetIpNetEntry
CreateIpNetEntry
NotifyAddrChange
GetIfTable
GetOwnerModuleFromTcpEntry
GetUniDirectionalAdapterInfo
GetUdpTable
GetIpStatistics
EnableRouter
CancelIPChangeNotify
UnenableRouter
FlushIpNetTable
GetPerAdapterInfo
GetIpForwardTable
DeleteIPAddress
GetTcpTable
msi
ord270
ord84
ord141
ord193
ord89
ord231
ord267
ord44
ord9
ord261
ord219
ord248
ord72
ord276
ord126
ord203
ord137
ord245
ord213
ord93
ord109
ord172
ord190
ord113
ord173
ord228
msimg32
AlphaBlend
Sections
.text Size: 171KB - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE