Static task
static1
Behavioral task
behavioral1
Sample
dba66f7455e00a91c7d1d1d91b7b009e_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
dba66f7455e00a91c7d1d1d91b7b009e_JaffaCakes118
-
Size
485KB
-
MD5
dba66f7455e00a91c7d1d1d91b7b009e
-
SHA1
7109f39d4c876edddcbf4b1d30e614f287b3965a
-
SHA256
f50eff81fecf402ac8b5a9d512e41c873b1e0eb6f5ddf8e84382a22a840cdaea
-
SHA512
ca074f0d650ecd6c03f5c8bd1cb437707a6b674f7151962a28113d113bd108dd934c62d7909ea4c458398728d692d15a89fa01360f12031da4814dd8025016a1
-
SSDEEP
6144:TfeRCBmlee/2eEmBA1Yf0blovMfX5y+sq2tTBo18CRgwvpywOy+SnAdvCsCI:TfeRCBmGJ1YahIq2tTm1bRvgFzdvsI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dba66f7455e00a91c7d1d1d91b7b009e_JaffaCakes118
Files
-
dba66f7455e00a91c7d1d1d91b7b009e_JaffaCakes118.exe windows:4 windows x86 arch:x86
329042903c2b611d3ed5c132ca82640c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
InterlockedIncrement
GetTempPathW
lstrcpyW
GetShortPathNameW
RemoveDirectoryW
ReadFile
CreateFileW
DeviceIoControl
CreateEventW
SetEvent
TlsSetValue
IsBadWritePtr
IsBadReadPtr
CancelWaitableTimer
WaitForMultipleObjects
ResetEvent
GetTempFileNameW
SetWaitableTimer
CreateWaitableTimerW
SystemTimeToFileTime
GetDiskFreeSpaceExW
SetFileTime
SetEndOfFile
SetFilePointer
WriteFile
FindClose
FindNextFileW
SetFileAttributesW
GetFileAttributesW
FindFirstFileW
GetFileSize
CreateDirectoryW
GetSystemTime
LocalFree
WritePrivateProfileStringW
GetPrivateProfileStructW
TerminateProcess
OpenProcess
lstrcmpA
lstrcmpiA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetPrivateProfileSectionNamesW
GlobalMemoryStatusEx
GetSystemInfo
GetWindowsDirectoryW
GetLocalTime
GetTickCount
GetCurrentProcess
DeleteFileW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetExitCodeProcess
GetLongPathNameW
GetVersionExW
SuspendThread
TerminateThread
lstrcpyA
VirtualAlloc
VirtualFree
GetStartupInfoA
GetModuleHandleA
SetErrorMode
CreateMutexW
GetLastError
CreateThread
InterlockedDecrement
lstrcpynA
GetModuleFileNameW
lstrcpynW
lstrcatW
lstrlenA
MultiByteToWideChar
MoveFileExW
CopyFileW
FreeLibrary
WaitForSingleObject
lstrlenW
WideCharToMultiByte
LoadLibraryW
GetProcAddress
Sleep
CreateProcessW
CloseHandle
LocalAlloc
user32
GetDesktopWindow
ShowWindow
wsprintfA
PostQuitMessage
EndPaint
CreateDialogParamW
KillTimer
SetWindowPos
CreateWindowExW
GetMessageW
PostMessageW
FindWindowW
BeginPaint
DefWindowProcW
RegisterClassExW
LoadCursorW
UnregisterClassW
MessageBoxW
TranslateMessage
DispatchMessageW
FindWindowExW
IsWindow
SetTimer
wsprintfW
CharNextW
CharLowerW
LoadImageW
IsWindowEnabled
SetDlgItemTextW
EnableWindow
GetWindowTextW
SetWindowTextW
GetSystemMetrics
LoadIconW
GetWindowRect
ScreenToClient
MoveWindow
PostThreadMessageW
GetDlgItem
PeekMessageW
DestroyWindow
SendMessageW
GetClientRect
RemovePropW
CheckDlgButton
SetPropW
GetPropW
EndDialog
DialogBoxParamW
LoadStringW
gdi32
CreateFontIndirectW
GetObjectW
advapi32
RegDeleteKeyW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegUnLoadKeyW
RegCloseKey
RegSaveKeyW
RegOpenKeyExW
RegLoadKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
RegEnumKeyExW
RegDeleteValueW
shell32
ord680
ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW
ole32
CoUninitialize
CoInitialize
OleUninitialize
OleInitialize
CoCreateInstance
OleCreate
CoTaskMemFree
StringFromCLSID
oleaut32
SysAllocString
VariantClear
SysFreeString
shlwapi
PathIsRootW
PathCombineW
PathRemoveFileSpecW
PathRemoveExtensionW
StrStrIW
PathGetDriveNumberW
PathFindFileNameW
SHDeleteValueW
SHSetValueW
SHGetValueW
PathAppendW
PathFileExistsW
SHGetValueA
StrStrW
StrToIntW
SHDeleteKeyW
wininet
HttpSendRequestExW
InternetGetConnectedState
HttpEndRequestW
HttpAddRequestHeadersW
HttpSendRequestW
InternetCloseHandle
HttpOpenRequestW
GetUrlCacheEntryInfoW
CreateUrlCacheEntryW
CommitUrlCacheEntryW
HttpQueryInfoW
FtpGetFileSize
InternetSetOptionA
InternetSetStatusCallbackW
InternetReadFileExA
InternetReadFile
FtpOpenFileW
InternetWriteFile
InternetGetLastResponseInfoW
FtpCommandW
InternetQueryOptionW
InternetSetOptionW
InternetCrackUrlW
InternetOpenW
InternetConnectW
urlmon
ObtainUserAgentString
comctl32
InitCommonControlsEx
atl
ord39
ord47
ord42
msvcp60
??0Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?_Refcnt@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEAAEPBG@Z
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Xlen@std@@YAXXZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??1Init@ios_base@std@@QAE@XZ
msvcrt
sprintf
_beginthreadex
_strnicmp
fgets
rewind
_wcsnicmp
wcscmp
_wfopen
_filelength
atof
_purecall
_onexit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_stricmp
isalnum
memcmp
fseek
ftell
fread
fgetws
wcscpy
fclose
fwrite
wcschr
wcsstr
wcsncat
_itow
_wtoi
wcscat
_waccess
strncpy
strncmp
??2@YAPAXI@Z
__p___argc
__p___argv
atoi
exit
wcsrchr
_snwprintf
wcsncpy
__CxxFrameHandler
_wcsicmp
wcslen
isprint
isspace
tolower
_ui64tow
time
_wtol
_ftol
_wtoi64
fprintf
_vsnprintf
_vsnwprintf
swprintf
free
malloc
vswprintf
iswdigit
_snprintf
memmove
_except_handler3
_strlwr
strncat
swscanf
wcsncmp
_ltow
fwprintf
memcpy
iswspace
memset
realloc
__dllonexit
setupapi
SetupIterateCabinetW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
wintrust
WinVerifyTrust
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
psapi
GetModuleBaseNameW
EnumProcesses
EnumProcessModules
netapi32
Netbios
Sections
.text Size: 204KB - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 48KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 28KB - Virtual size: 450KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE