Static task
static1
Behavioral task
behavioral1
Sample
dd44beb8743050d41e168a0521010f0e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dd44beb8743050d41e168a0521010f0e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dd44beb8743050d41e168a0521010f0e_JaffaCakes118
-
Size
864KB
-
MD5
dd44beb8743050d41e168a0521010f0e
-
SHA1
b1c71ce6c9c79098dee4ed7d26052a552016959a
-
SHA256
e2b38b61b9d5cd31668013524476828e930f2e47200f8afea1a8f258be8979e9
-
SHA512
7f1dbbb0db3a4de294a9875683302ef7cc93763a016678a2aecdad04c71bf6c9eaeb09c187585228883fcb442b5a8fc945ad557b6e9054e87602ee731d6fed7f
-
SSDEEP
24576:arPXKJ9olFPHNW4BSiNj5PDhdjilaYu5pgDC1Lfk6:MPm98Ptm0NPDDyaY9eZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd44beb8743050d41e168a0521010f0e_JaffaCakes118
Files
-
dd44beb8743050d41e168a0521010f0e_JaffaCakes118.exe windows:5 windows x86 arch:x86
081f431c1244dfd28e9e9cb1e9585db7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp60
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@XZ
?pubimbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?sync@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEHXZ
?max@?$numeric_limits@H@std@@SAHXZ
??Nstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Init@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?denorm_min@?$numeric_limits@C@std@@SACXZ
??_F?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
?grouping@?$numpunct@G@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAC@Z
?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
??4?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
??0?$_Mpunct@D@std@@QAE@ABV_Locinfo@1@I_N@Z
??_D?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??4?$numeric_limits@N@std@@QAEAAV01@ABV01@@Z
??Kstd@@YA?AV?$complex@N@0@ABV10@ABN@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Init@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?pubsync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEHXZ
?do_widen@?$ctype@G@std@@MBEGD@Z
?round_error@?$numeric_limits@G@std@@SAGXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??Dstd@@YA?AV?$complex@M@0@ABV10@0@Z
?precision@ios_base@std@@QAEHH@Z
??1?$codecvt@DDH@std@@UAE@XZ
advapi32
CancelOverlappedAccess
ElfBackupEventLogFileA
PrivilegedServiceAuditAlarmA
SystemFunction001
CryptEncrypt
ConvertSecurityDescriptorToAccessNamedW
BuildImpersonateTrusteeW
SetPrivateObjectSecurity
CryptEnumProviderTypesW
CryptSetHashParam
StartServiceCtrlDispatcherW
GetMultipleTrusteeOperationA
LsaAddAccountRights
RegLoadKeyW
LogonUserExA
GetTrusteeFormW
GetAuditedPermissionsFromAclW
AccessCheckByType
BuildImpersonateTrusteeA
ConvertStringSidToSidA
CryptGetKeyParam
FreeInheritedFromArray
SaferiCompareTokenLevels
StartTraceA
FileEncryptionStatusA
DecryptFileW
SystemFunction036
QueryServiceConfigW
GetSecurityInfoExA
SystemFunction004
PrivilegeCheck
IsTextUnicode
TrusteeAccessToObjectA
SetSecurityDescriptorDacl
WriteEncryptedFileRaw
InitializeSid
LsaSetSystemAccessAccount
CryptExportKey
GetTraceEnableLevel
WmiFileHandleToInstanceNameA
InitializeAcl
CryptImportKey
LookupSecurityDescriptorPartsA
AdjustTokenPrivileges
CredProfileLoaded
CryptEnumProvidersA
GetAccessPermissionsForObjectW
GetUserNameW
QueryServiceConfig2W
SystemFunction003
CredDeleteW
SystemFunction028
GetInheritanceSourceA
WmiFreeBuffer
InstallApplication
LsaICLookupSids
SaferiSearchMatchingHashRules
BuildTrusteeWithNameA
OpenServiceW
RegEnumValueA
OpenBackupEventLogW
CryptDestroyKey
GetEventLogInformation
CredGetSessionTypes
GetTrusteeTypeW
LsaSetQuotasForAccount
LsaQueryDomainInformationPolicy
CredpEncodeCredential
CredIsMarshaledCredentialW
CheckTokenMembership
CryptVerifySignatureW
EncryptedFileKeyInfo
OpenEventLogA
WmiMofEnumerateResourcesW
OpenServiceA
QueryAllTracesA
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSDToSDDomainW
SystemFunction020
LsaLookupNames
GetSecurityDescriptorLength
CryptSetKeyParam
SystemFunction018
CryptSetProviderW
hlink
HlinkTranslateURL
HlinkUpdateStackItem
HlinkResolveShortcutToMoniker
OleSaveToStreamEx
HlinkNavigate
HlinkCreateFromData
HlinkCreateBrowseContext
HlinkCreateShortcutFromMoniker
HlinkOnRenameDocument
HlinkClone
HlinkCreateShortcutFromString
HlinkResolveShortcut
DllGetClassObject
HlinkCreateFromString
HlinkGetValueFromParams
HlinkResolveStringForData
HlinkResolveShortcutToString
HlinkCreateShortcut
HlinkSetSpecialReference
HlinkOnNavigate
HlinkCreateFromMoniker
HlinkIsShortcut
HlinkGetSpecialReference
HlinkNavigateToStringReference
HlinkResolveMonikerForData
HlinkQueryCreateFromData
HlinkParseDisplayName
HlinkPreprocessMoniker
HlinkCreateExtensionServices
kernel32
IsDBCSLeadByteEx
ShowConsoleCursor
RegisterWaitForSingleObjectEx
GetDiskFreeSpaceExW
CallNamedPipeW
GetCPInfoExA
LeaveCriticalSection
GetPriorityClass
Beep
SetFileApisToOEM
LoadLibraryA
GetConsoleAliasExesLengthA
SetProcessAffinityMask
BackupSeek
WriteProfileStringW
DeleteCriticalSection
lstrcmpi
ReadProcessMemory
ExpandEnvironmentStringsW
SetLocaleInfoW
CreateActCtxA
GetCommMask
SetLastConsoleEventActive
AddRefActCtx
CreateProcessInternalA
VirtualAlloc
EnterCriticalSection
GetFileSizeEx
ReadFileScatter
ExitProcess
lstrcatW
GetFirmwareEnvironmentVariableA
SetThreadAffinityMask
dsuiext
DllInstall
DsBrowseForContainerW
DsBrowseForContainerA
DsGetIcon
DllGetClassObject
DsGetFriendlyClassName
qmgrprxy
DllGetClassObject
panmap
DllGetClassObject
msimtf
DllGetClassObject
Sections
.text Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 274KB - Virtual size: 273KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 494KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ