Behavioral task
behavioral1
Sample
c7f40c3556ed3c89907f0b093f17ccf3_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c7f40c3556ed3c89907f0b093f17ccf3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c7f40c3556ed3c89907f0b093f17ccf3_JaffaCakes118
-
Size
952KB
-
MD5
c7f40c3556ed3c89907f0b093f17ccf3
-
SHA1
240f583d9cf76d12c7121899ca4fe0c699cd370e
-
SHA256
4d335b0efd8dce8603312c2c58b641a78a403394f91dae2db61e307b9083d2e8
-
SHA512
b4b742a5516dad2424dbe6528e687c5c7455d10250f32fa6158cb30435646ccf35c1ee884997b70bf4f4a388d4cc6e7238f11833e4102e5d290774c3882b7448
-
SSDEEP
24576:dQb25gwPvBR5dZ5nUHb+wxttqRF+5VfDa+/KN9JFO2Yxvdi6n:dq22YHnUHb+wxttqRF+5VLa+MFO2I
Malware Config
Signatures
-
Privateloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c7f40c3556ed3c89907f0b093f17ccf3_JaffaCakes118
Files
-
c7f40c3556ed3c89907f0b093f17ccf3_JaffaCakes118.exe windows:6 windows x64 arch:x64
b04be6f32d728db2cc693739c33265b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Process32Next
GetStdHandle
GetConsoleMode
ReadConsoleA
SetConsoleMode
FormatMessageA
FreeLibrary
GetProcAddress
LoadLibraryA
SetThreadAffinityMask
CloseHandle
GetCurrentProcess
VirtualAlloc
VirtualFree
Process32First
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
CreateToolhelp32Snapshot
MultiByteToWideChar
GlobalLock
GlobalUnlock
GlobalAlloc
OpenProcess
GetCurrentProcessId
Sleep
CreateMutexA
GetLastError
GetLargePageMinimum
DeleteFileA
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SwitchToThread
SetProcessAffinityMask
GetProcessAffinityMask
GetCurrentThread
GetSystemInfo
RtlCaptureContext
user32
EmptyClipboard
IsClipboardFormatAvailable
FindWindowA
SetClipboardData
CloseClipboard
OpenClipboard
GetClipboardData
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetKernelObjectSecurity
msvcp140
_Cnd_wait
_Cnd_signal
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Strcoll
_Strxfrm
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??Bid@locale@std@@QEAA_KXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Cnd_init
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_BADOFF@std@@3_JB
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?_Syserror_map@std@@YAPEBDH@Z
_Xtime_get_ticks
_Thrd_sleep
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_broadcast
_Cnd_register_at_thread_exit
_Cnd_unregister_at_thread_exit
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
_Thrd_join
_Thrd_id
_Mtx_current_owns
_Cnd_timedwait
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Thrd_yield
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Cnd_destroy
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Thrd_start
_Query_perf_counter
_Query_perf_frequency
_Thrd_detach
_Mtx_init
_Mtx_destroy
_Mtx_lock
_Mtx_unlock
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
winhttp
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpOpen
WinHttpSendRequest
vcruntime140
strchr
memmove
__std_terminate
_purecall
strrchr
__vcrt_InitializeCriticalSectionEx
__std_exception_copy
__C_specific_handler
strstr
memset
memcpy
memcmp
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
memchr
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
__p___argc
_errno
__p___argv
_exit
_initterm_e
_initterm
exit
_initialize_onexit_table
terminate
_cexit
_get_initial_narrow_environment
_control87
_initialize_narrow_environment
_configure_narrow_argv
_c_exit
strerror
_invalid_parameter_noinfo
_register_thread_local_exe_atexit_callback
abort
_set_app_type
_seh_filter_exe
_crt_atexit
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
malloc
calloc
_aligned_free
free
_aligned_malloc
_callnewh
realloc
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
fread
__stdio_common_vfprintf
fseek
ftell
rewind
__stdio_common_vsprintf
__stdio_common_vsscanf
ungetc
setvbuf
__acrt_iob_func
_fseeki64
fsetpos
fputc
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
fputs
ferror
fwrite
__p__commode
_set_fmode
fopen
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
isspace
_strdup
tolower
strtok
strncpy
strcmp
_strnicmp
strcspn
strspn
toupper
strncmp
_stricmp
api-ms-win-crt-environment-l1-1-0
getenv_s
getenv
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
strftime
api-ms-win-crt-math-l1-1-0
__setusermatherr
nan
_dtest
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wsock32
setsockopt
closesocket
connect
send
recv
WSAGetLastError
WSAStartup
socket
shutdown
ws2_32
getaddrinfo
freeaddrinfo
api-ms-win-crt-convert-l1-1-0
strtoul
atof
_strtoui64
strtol
atoi
Sections
.text Size: 794KB - Virtual size: 793KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ