Behavioral task
behavioral1
Sample
be52a2a3074a014b163096055df127a0_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
be52a2a3074a014b163096055df127a0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
be52a2a3074a014b163096055df127a0_JaffaCakes118
-
Size
4.1MB
-
MD5
be52a2a3074a014b163096055df127a0
-
SHA1
f3614c5a15b744a5973df1b490f7e145bb0ab11d
-
SHA256
97d8ea6cee63296eaf0fa5d97a14898d7cec6fa49fee1bf77c015ca7117a2ba7
-
SHA512
01da83a428c37a85a32663d535f7fc51da6c528eb65851deea2b5dae86f68b287de6676c9fcf43337377488d0881d443a6cc1435c143b218c3cd5cfc9bf78998
-
SSDEEP
49152:KxizaJwT9WRNHaVZMWV+EAKftvNHGA7nhi44yPMy0Qo1u8K5iv2kE3qyapdXpTx5:KFHaVZMWV+EHZG+6v2R+DxSQ+kyHDM
Malware Config
Signatures
Files
-
be52a2a3074a014b163096055df127a0_JaffaCakes118.exe windows:6 windows x64 arch:x64
568457d5d57de889bfefba6997ef8357
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
getpeername
recv
send
select
WSARecvFrom
WSAIoctl
WSASend
shutdown
WSASocketW
ntohs
WSARecv
FreeAddrInfoW
GetAddrInfoW
gethostname
htonl
htons
socket
setsockopt
listen
closesocket
bind
WSACleanup
WSAStartup
getsockopt
getsockname
ioctlsocket
WSAGetLastError
WSASetLastError
psapi
GetProcessMemoryInfo
iphlpapi
GetAdaptersAddresses
crypt32
CertFindCertificateInStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
kernel32
GetStdHandle
SetConsoleMode
GetConsoleMode
SizeofResource
LockResource
LoadResource
FindResourceW
ExpandEnvironmentStringsA
CreateMutexW
WaitForSingleObject
CreateEventW
ExitProcess
MultiByteToWideChar
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
GetProcAddress
GetModuleHandleW
CloseHandle
FreeConsole
GetConsoleWindow
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
GetLastError
LocalFree
FlushInstructionCache
WriteFile
DeviceIoControl
GetModuleFileNameW
CreateFileW
GetCurrentThreadId
DeleteFileW
AddVectoredExceptionHandler
SetLastError
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
GetFileType
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
LoadLibraryW
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
DuplicateHandle
PostQueuedCompletionStatus
QueueUserWorkItem
Sleep
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
SetEvent
ResetEvent
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
SetConsoleCursorPosition
CreateEventA
SetConsoleTitleA
ReadFile
GetNumaHighestNodeNumber
GetFileSizeEx
GetDiskFreeSpaceW
RemoveDirectoryW
GetFinalPathNameByHandleW
SetFileTime
ReOpenFile
CreateHardLinkW
GetFileAttributesW
UnmapViewOfFile
GetFileInformationByHandle
FlushViewOfFile
GetSystemInfo
SetFilePointerEx
CreateFileMappingA
MoveFileExW
CopyFileW
CreateSymbolicLinkW
MapViewOfFile
FlushFileBuffers
GetLongPathNameW
GetShortPathNameW
GetCurrentDirectoryW
ReadDirectoryChangesW
CreateIoCompletionPort
VerifyVersionInfoA
SetEnvironmentVariableW
InitializeCriticalSection
GetVersionExW
FreeEnvironmentStringsW
RtlUnwind
FileTimeToSystemTime
QueryPerformanceFrequency
VerSetConditionMask
GlobalMemoryStatusEx
GetEnvironmentStringsW
SetConsoleCtrlHandler
CancelIo
SetHandleInformation
SetFileCompletionNotificationModes
FormatMessageA
LoadLibraryExW
SetErrorMode
GetQueuedCompletionStatus
GetQueuedCompletionStatusEx
SetNamedPipeHandleState
CreateNamedPipeW
PeekNamedPipe
CancelSynchronousIo
GetNamedPipeHandleStateA
CancelIoEx
SwitchToThread
ConnectNamedPipe
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
SleepConditionVariableCS
TryEnterCriticalSection
ReleaseSemaphore
WakeConditionVariable
InitializeConditionVariable
ResumeThread
GetNativeSystemInfo
CreateSemaphoreA
GetModuleHandleA
DebugBreak
GetStartupInfoW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileInformationByHandleEx
GetThreadTimes
FreeLibraryAndExitThread
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetCommandLineA
GetCommandLineW
ExitThread
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
SetStdHandle
GetConsoleCP
GetFileAttributesExW
SetFileAttributesW
HeapReAlloc
HeapFree
HeapAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
HeapSize
GetFullPathNameW
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
CreateDirectoryW
RtlVirtualUnwind
RtlLookupFunctionEntry
WaitForSingleObjectEx
GetExitCodeThread
GetTickCount
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
GetLocaleInfoW
GetStringTypeW
RtlCaptureContext
user32
GetSystemMetrics
GetMessageA
MapVirtualKeyW
DispatchMessageA
TranslateMessage
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
ShowWindow
shell32
SHGetSpecialFolderPathA
advapi32
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
QueryServiceConfigA
DeleteService
ControlService
StartServiceW
OpenServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
bcrypt
BCryptGenRandom
Sections
.text Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 846KB - Virtual size: 845KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 272KB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RANDOMX Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ