Static task
static1
Behavioral task
behavioral1
Sample
e2809cf1ccceb45cb836e5e9727114d6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e2809cf1ccceb45cb836e5e9727114d6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e2809cf1ccceb45cb836e5e9727114d6_JaffaCakes118
-
Size
415KB
-
MD5
e2809cf1ccceb45cb836e5e9727114d6
-
SHA1
0cbfd23b50a2bff628d5bba9c41836e075766de2
-
SHA256
4bdff7120e963fab518d7881aec9d0eafcb8c2926285e1197c513696805e5017
-
SHA512
64dfddcb3bb079ddd8c6931e8eb724d88c05b6471b69ad2ce7a1f0824a833be7ab8122e7d8518483df24b758ffb6ee22175d162002ee8babc85e1d2282794f62
-
SSDEEP
12288:1JXVw4RPTb5t2wv9lBk6lPYSKH4qx0Qph:zXVwG/HvmbH4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2809cf1ccceb45cb836e5e9727114d6_JaffaCakes118
Files
-
e2809cf1ccceb45cb836e5e9727114d6_JaffaCakes118.exe windows:4 windows x86 arch:x86
199a9a4eb9e8c79e2d8f799c1849de41
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
HeapReAlloc
HeapAlloc
HeapFree
VirtualAlloc
GetVolumeInformationW
GlobalLock
GetAtomNameW
GlobalUnlock
WritePrivateProfileStringW
DefineDosDeviceW
WriteConsoleOutputCharacterW
GetLogicalDrives
ExpandEnvironmentStringsW
WritePrivateProfileStructA
CreateDirectoryW
VirtualFreeEx
InterlockedCompareExchange
GetPrivateProfileSectionW
GlobalHandle
GetLastError
LoadLibraryExA
EnumDateFormatsExA
GetPrivateProfileStructA
TransmitCommChar
GetFileAttributesA
GlobalDeleteAtom
GlobalWire
GetNumberFormatW
GetPrivateProfileIntA
GetEnvironmentStringsW
HeapWalk
GetCurrentDirectoryW
SetThreadExecutionState
GetSystemPowerStatus
PeekConsoleInputW
SetLocaleInfoA
MapViewOfFileEx
WriteProfileSectionA
WriteProcessMemory
Heap32First
WriteProfileStringA
HeapDestroy
GetWriteWatch
ResumeThread
WriteProfileStringW
GetCompressedFileSizeW
GetTimeZoneInformation
FindCloseChangeNotification
LocalAlloc
TransactNamedPipe
CreateConsoleScreenBuffer
FreeEnvironmentStringsW
GetNumberOfConsoleMouseButtons
CreateMutexA
FormatMessageA
ReleaseMutex
OpenProcess
GlobalAddAtomW
DuplicateHandle
GlobalCompact
CreateFileA
ReadConsoleA
TlsFree
CreateFileW
FileTimeToSystemTime
GetFileTime
LockFile
GetProcessVersion
WriteFileGather
SetTimeZoneInformation
GetPriorityClass
GetCurrencyFormatW
ConvertDefaultLocale
SetFileTime
SetConsoleCtrlHandler
MoveFileExW
GetUserDefaultLangID
EnumCalendarInfoA
EnumDateFormatsW
SetThreadPriorityBoost
WriteConsoleOutputW
LocalFlags
CreateFileMappingA
Module32Next
ReadFileEx
ContinueDebugEvent
SetComputerNameA
InterlockedIncrement
GetWindowsDirectoryW
lstrcpynW
SearchPathA
MoveFileW
EnumResourceLanguagesW
EnumTimeFormatsA
GetVersionExW
DefineDosDeviceA
DosDateTimeToFileTime
GetTempPathA
FoldStringA
SetComputerNameW
GetWindowsDirectoryA
GlobalMemoryStatus
GetDateFormatW
GlobalFree
CommConfigDialogA
WritePrivateProfileStructW
EnumSystemLocalesW
OpenMutexW
CreateNamedPipeA
GetProcessHeaps
GetSystemDefaultLCID
LoadResource
lstrcpyA
GetEnvironmentStrings
FindResourceW
GetFileInformationByHandle
MoveFileExA
WritePrivateProfileSectionW
GlobalReAlloc
EnumResourceLanguagesA
lstrcmpW
CreateThread
GetShortPathNameA
OpenFile
LocalShrink
lstrcatA
ReleaseSemaphore
GlobalFindAtomW
SystemTimeToTzSpecificLocalTime
GetTimeFormatA
GetCommandLineA
LoadLibraryW
GetFileSize
GetProfileIntA
GetCurrencyFormatA
MultiByteToWideChar
GetSystemInfo
GetLocaleInfoW
SetSystemTime
RemoveDirectoryA
lstrcmpiW
CreateEventA
AddAtomW
GetComputerNameA
DeleteAtom
FoldStringW
SetConsoleWindowInfo
OpenMutexA
SetEvent
FindNextChangeNotification
SetEndOfFile
EnumCalendarInfoExA
WriteConsoleW
ReadConsoleInputA
CreateWaitableTimerA
LocalFileTimeToFileTime
CreateSemaphoreW
InterlockedExchangeAdd
CreateDirectoryExW
lstrcpy
SetConsoleCursorInfo
LocalSize
GetConsoleOutputCP
DebugActiveProcess
GetTempPathW
SetThreadLocale
EnumDateFormatsExW
GetNamedPipeInfo
GetStartupInfoA
LocalLock
GetProfileStringA
WriteConsoleA
SetConsoleCP
SetLocalTime
EnumResourceTypesA
LocalHandle
TlsAlloc
GetUserDefaultLCID
WritePrivateProfileSectionA
GetFileAttributesExA
DeleteFileA
HeapCompact
GetTempFileNameA
lstrcmp
TlsGetValue
FreeResource
SetCurrentDirectoryA
FindFirstFileW
EnumCalendarInfoW
EnumTimeFormatsW
SearchPathW
GetNamedPipeHandleStateA
HeapLock
GetConsoleTitleW
GetExitCodeProcess
Sleep
SignalObjectAndWait
CreateDirectoryExA
InitializeCriticalSection
GetDiskFreeSpaceExW
MapViewOfFile
SetConsoleMode
DeleteFiber
OpenSemaphoreW
lstrcpyW
BeginUpdateResourceA
GetLogicalDriveStringsW
WriteConsoleOutputCharacterA
GetDriveTypeW
Module32First
DisconnectNamedPipe
SetConsoleTitleW
SetSystemTimeAdjustment
GlobalGetAtomNameA
FlushViewOfFile
GetQueuedCompletionStatus
GetProcessTimes
GetTimeFormatW
GetCommandLineW
VirtualProtectEx
InitAtomTable
lstrlenW
OpenWaitableTimerW
SetFileAttributesW
SetWaitableTimer
OpenEventA
FlushInstructionCache
GetACP
VirtualProtect
FindAtomW
OutputDebugStringA
GlobalAddAtomA
ReadConsoleOutputCharacterA
GetCalendarInfoA
RemoveDirectoryW
WriteConsoleOutputAttribute
FindFirstFileExA
HeapUnlock
SetHandleCount
SetFileAttributesA
SetCriticalSectionSpinCount
ReadConsoleOutputAttribute
GlobalFlags
GetLongPathNameA
GetStartupInfoW
CreateFileMappingW
SetLastError
SetConsoleCursorPosition
EnumSystemLocalesA
CreateMailslotW
EnumCalendarInfoExW
VirtualQueryEx
GetStdHandle
Thread32First
CopyFileA
OutputDebugStringW
Toolhelp32ReadProcessMemory
GlobalAlloc
CreateWaitableTimerW
ResetWriteWatch
CreateDirectoryA
WaitForDebugEvent
CreatePipe
GlobalUnfix
GetConsoleCursorInfo
lstrcpynA
FlushConsoleInputBuffer
ExpandEnvironmentStringsA
ReadDirectoryChangesW
EnterCriticalSection
CommConfigDialogW
FreeLibraryAndExitThread
Heap32ListFirst
GetLocalTime
VirtualFree
CreateMailslotA
GetConsoleMode
GetPrivateProfileSectionNamesA
lstrcatW
UnlockFile
GetEnvironmentVariableA
FindFirstFileExW
WaitForSingleObject
DeleteCriticalSection
CreateNamedPipeW
LocalReAlloc
lstrcat
GetNamedPipeHandleStateW
GlobalFix
LockResource
GetConsoleScreenBufferInfo
WriteProfileSectionW
GetStringTypeExA
Thread32Next
GetExitCodeThread
GetCalendarInfoW
WritePrivateProfileStringA
WriteFile
GetPrivateProfileStringW
GlobalUnWire
GetFileType
HeapValidate
GetProfileStringW
LeaveCriticalSection
WaitForMultipleObjects
SetConsoleTitleA
CompareFileTime
GetThreadTimes
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
WideCharToMultiByte
GetFileAttributesW
ReadConsoleOutputA
LocalCompact
GetModuleHandleW
GetProcessPriorityBoost
UnlockFileEx
InitializeCriticalSectionAndSpinCount
GetCompressedFileSizeA
WaitNamedPipeW
DeviceIoControl
CloseHandle
GlobalSize
FindAtomA
SetThreadAffinityMask
FillConsoleOutputCharacterA
SetConsoleScreenBufferSize
WinExec
FindFirstFileA
LocalUnlock
GlobalFindAtomA
FileTimeToLocalFileTime
GetSystemTimeAdjustment
UpdateResourceW
SetConsoleActiveScreenBuffer
UnmapViewOfFile
LocalFree
GetCurrentDirectoryA
ReadConsoleOutputCharacterW
EnumResourceTypesW
SetVolumeLabelW
GetFullPathNameA
WaitForMultipleObjectsEx
VirtualLock
GetLongPathNameW
Process32Next
MoveFileA
GetEnvironmentVariableW
EscapeCommFunction
Heap32Next
FlushFileBuffers
OpenWaitableTimerA
lstrcmpA
FindResourceExW
EnumSystemCodePagesA
ReadProcessMemory
TerminateThread
GetProcessAffinityMask
SetThreadContext
CreateProcessA
RtlFillMemory
FormatMessageW
FreeLibrary
GetCurrentThread
GetPrivateProfileSectionA
FreeConsole
GetShortPathNameW
FindNextFileA
FindResourceExA
GetNumberOfConsoleInputEvents
IsValidLocale
AllocConsole
GetConsoleTitleA
SystemTimeToFileTime
ConnectNamedPipe
lstrcmpiA
GetThreadPriority
MulDiv
GetLocaleInfoA
comdlg32
ChooseFontA
ChooseFontW
LoadAlterBitmap
PageSetupDlgW
GetOpenFileNameA
ReplaceTextA
FindTextA
FindTextW
PrintDlgA
GetOpenFileNameW
GetFileTitleW
ReplaceTextW
GetSaveFileNameW
wininet
InternetGetConnectedStateExA
FtpCreateDirectoryW
RetrieveUrlCacheEntryFileW
InternetSecurityProtocolToStringW
ShowClientAuthCerts
FtpCommandA
shell32
SHGetPathFromIDList
DragQueryFileAorW
advapi32
LookupPrivilegeNameA
CryptSetProviderW
CryptAcquireContextW
CreateServiceW
CryptSetProviderExA
RegDeleteValueW
LookupPrivilegeValueW
RegSetValueA
RegCloseKey
LogonUserW
CryptGenRandom
CryptSetHashParam
RegOpenKeyW
CryptDestroyHash
RegQueryInfoKeyA
RegQueryMultipleValuesW
CryptGetHashParam
RegSetValueW
CryptVerifySignatureA
GetUserNameA
CryptGetUserKey
CryptEnumProviderTypesA
LookupAccountNameW
InitiateSystemShutdownW
RegEnumKeyExW
RegEnumKeyExA
RegConnectRegistryW
CryptDecrypt
CryptDuplicateHash
CryptGetKeyParam
GetUserNameW
CreateServiceA
CryptDestroyKey
CryptImportKey
RegOpenKeyExA
CryptSetKeyParam
LookupPrivilegeDisplayNameW
CryptHashData
LookupSecurityDescriptorPartsA
CryptGetDefaultProviderA
RegQueryValueExW
LookupSecurityDescriptorPartsW
LookupPrivilegeNameW
AbortSystemShutdownW
RegEnumValueW
LookupPrivilegeDisplayNameA
RegSetValueExW
CryptSetProviderA
RegDeleteKeyA
CryptEnumProviderTypesW
LookupAccountSidW
CryptExportKey
DuplicateToken
CryptGetDefaultProviderW
RegSetKeySecurity
CryptDeriveKey
CryptEncrypt
CryptGetProvParam
CryptEnumProvidersA
CryptSignHashA
RevertToSelf
RegSaveKeyA
CryptContextAddRef
StartServiceA
RegLoadKeyA
RegQueryValueW
CryptSetProviderExW
LookupPrivilegeValueA
ReportEventA
RegRestoreKeyA
RegQueryMultipleValuesA
CryptHashSessionKey
RegCreateKeyW
RegSetValueExA
CryptSetProvParam
LogonUserA
RegDeleteKeyW
InitiateSystemShutdownA
RegQueryInfoKeyW
RegCreateKeyA
CryptCreateHash
DuplicateTokenEx
CryptGenKey
AbortSystemShutdownA
RegEnumValueA
StartServiceW
LookupAccountNameA
CryptVerifySignatureW
ReportEventW
RegNotifyChangeKeyValue
RegSaveKeyW
RegOpenKeyA
RegEnumKeyW
RegReplaceKeyW
CryptSignHashW
RegEnumKeyA
RegFlushKey
RegConnectRegistryA
CryptReleaseContext
CryptEnumProvidersW
RegCreateKeyExW
CryptDuplicateKey
RegQueryValueExA
RegReplaceKeyA
RegLoadKeyW
RegDeleteValueA
RegQueryValueA
RegOpenKeyExW
CryptAcquireContextA
RegRestoreKeyW
user32
GetTitleBarInfo
FindWindowExA
GetClipboardSequenceNumber
DdeReconnect
GetActiveWindow
DefWindowProcW
GetKeyState
GetClientRect
SetShellWindow
GetDoubleClickTime
WaitMessage
GetPriorityClipboardFormat
OpenWindowStationW
DrawIconEx
EditWndProc
ReplyMessage
GetDlgCtrlID
DialogBoxParamA
LoadMenuIndirectW
SetWinEventHook
GetKeyNameTextA
DlgDirSelectExW
SetThreadDesktop
CharPrevExA
CopyImage
GetSystemMetrics
DlgDirSelectExA
DdeFreeStringHandle
DdeAbandonTransaction
MessageBoxExW
DrawStateA
UnregisterClassW
SetDlgItemInt
MonitorFromWindow
GetMenuItemInfoW
ShowOwnedPopups
UpdateWindow
SetRectEmpty
EndMenu
LoadImageW
TabbedTextOutA
TabbedTextOutW
DdeAddData
ImpersonateDdeClientWindow
InSendMessageEx
GetShellWindow
MoveWindow
SetClassLongW
DispatchMessageW
GetDCEx
InvalidateRgn
GetClipboardFormatNameW
CloseWindowStation
GetWindowModuleFileNameW
SetMenuItemInfoA
DrawEdge
CopyAcceleratorTableA
WINNLSGetEnableStatus
CharLowerBuffA
GetWindowTextA
UnregisterHotKey
GetNextDlgTabItem
SetUserObjectSecurity
CreateIconIndirect
SetMenuItemBitmaps
CreateDesktopW
CreateDialogParamW
InvertRect
IsWindowUnicode
GetProcessWindowStation
OpenDesktopA
GetMenuCheckMarkDimensions
OpenDesktopW
TileWindows
DefMDIChildProcA
SetWindowLongW
FindWindowW
EnumPropsW
DestroyCaret
SetPropW
WindowFromPoint
DdeUninitialize
EnumWindowStationsW
LoadBitmapA
GrayStringW
BlockInput
GetInputState
LoadAcceleratorsA
ChangeMenuA
IsChild
BeginPaint
ClientToScreen
GetWindowRect
ChangeDisplaySettingsA
SetScrollRange
GetClipboardViewer
GetCursorPos
RegisterClipboardFormatW
GetCursorInfo
GetSysColor
SetClipboardViewer
IsDlgButtonChecked
GrayStringA
DdeNameService
SendMessageA
KillTimer
CharUpperBuffA
SetUserObjectInformationW
wvsprintfA
RegisterDeviceNotificationA
LoadAcceleratorsW
IsMenu
InternalGetWindowText
EmptyClipboard
SetWindowTextA
GetKeyboardType
DdeDisconnect
LoadMenuA
TrackPopupMenuEx
GetMenuStringA
LoadCursorW
TranslateAcceleratorW
InsertMenuA
WaitForInputIdle
ReleaseCapture
CharPrevW
GetParent
DragDetect
SetWindowLongA
SetWindowContextHelpId
GetInputDesktop
CascadeWindows
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 262KB - Virtual size: 261KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ