Static task
static1
Behavioral task
behavioral1
Sample
eada75b332faf3edd19f3f5058652688_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eada75b332faf3edd19f3f5058652688_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eada75b332faf3edd19f3f5058652688_JaffaCakes118
-
Size
870KB
-
MD5
eada75b332faf3edd19f3f5058652688
-
SHA1
70f243ad1f0d1e9379c6f4faea68c416e926b574
-
SHA256
e1f68e106f105073dbda613d14db1b807efab65e0d7f3d3bd3e1955a1fb87954
-
SHA512
9524aba27046a1198c8ece69e991e89f03a6c32334abb568b9e2e56cb27a12579cca9812ff541d58b05b1c828e894bd2ba0a569ec610bc5f7e01063f49260dd8
-
SSDEEP
24576:YAwiRkhf1209a+KMefM2/9Y+NkcAbj8zC:twiMfU09PbeEOG/j8zC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eada75b332faf3edd19f3f5058652688_JaffaCakes118
Files
-
eada75b332faf3edd19f3f5058652688_JaffaCakes118.exe windows:5 windows x86 arch:x86
cde06b6ef4fc684b933fae72459f93cb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
FONTOBJ_pfdg
FONTOBJ_pQueryGlyphAttrs
DdEntry55
GdiAddGlsRecord
DdEntry46
CreateBitmapIndirect
PlayEnhMetaFile
DdEntry18
GetWinMetaFileBits
EngLineTo
GdiEntry4
SetSystemPaletteUse
AddFontResourceW
CLIPOBJ_bEnum
PolyDraw
EngFindResource
SetWindowOrgEx
SetWindowExtEx
GetCharWidthFloatA
EngDeletePalette
GetViewportOrgEx
PATHOBJ_bEnumClipLines
GdiInitSpool
SetColorSpace
GetMetaFileW
LPtoDP
GetBrushAttributes
GdiProcessSetup
GetStretchBltMode
PATHOBJ_bEnum
GetPaletteEntries
SetEnhMetaFileBits
GdiEntry2
AddFontResourceTracking
powrprof
WritePwrScheme
EnumPwrSchemes
MergeLegacyPwrScheme
SetActivePwrScheme
ValidatePowerPolicies
IsAdminOverrideActive
GetActivePwrScheme
CallNtPowerInformation
WriteProcessorPwrScheme
GetPwrCapabilities
IsPwrSuspendAllowed
DeletePwrScheme
ReadProcessorPwrScheme
LoadCurrentPwrScheme
CanUserWritePwrScheme
IsPwrHibernateAllowed
ReadGlobalPwrPolicy
GetPwrDiskSpindownRange
WriteGlobalPwrPolicy
GetCurrentPowerPolicies
SetSuspendState
IsPwrShutdownAllowed
ReadPwrScheme
kernel32
EnumCalendarInfoW
LZInit
SetThreadIdealProcessor
DeleteVolumeMountPointW
SetTimeZoneInformation
CreateSocketHandle
FindVolumeMountPointClose
WaitForSingleObject
ClearCommError
ExpungeConsoleCommandHistoryA
SetConsoleNlsMode
SetConsoleScreenBufferSize
CreateNamedPipeW
GetDateFormatA
LocalShrink
HeapCompact
SetInformationJobObject
CreateConsoleScreenBuffer
GetCurrentConsoleFont
FillConsoleOutputAttribute
SetConsoleTextAttribute
SetSystemTime
SetStdHandle
DnsHostnameToComputerNameA
RemoveDirectoryW
GlobalAddAtomW
OutputDebugStringA
GetTempPathW
GetNumaAvailableMemoryNode
FindClose
FreeEnvironmentStringsA
SearchPathW
GlobalHandle
GetCommandLineA
DeviceIoControl
ReadFileEx
GetVolumeInformationA
GetConsoleKeyboardLayoutNameA
GetVolumeInformationW
GetConsoleTitleA
CompareFileTime
ScrollConsoleScreenBufferW
SetHandleInformation
ExitVDM
HeapSize
CreateJobObjectW
GetACP
EnumerateLocalComputerNamesW
FindAtomA
SetVolumeLabelW
lstrcatA
OpenJobObjectA
GetProcessHeap
InterlockedFlushSList
EnumCalendarInfoExA
RtlFillMemory
GetDriveTypeA
InterlockedPushEntrySList
SetThreadUILanguage
WriteProfileStringA
EnumDateFormatsA
GetTapePosition
GetNativeSystemInfo
SetCommState
SetConsoleMode
lstrcmp
IsValidCodePage
lstrcpyA
GetEnvironmentStringsW
LoadLibraryExA
FoldStringA
FindCloseChangeNotification
GetNamedPipeInfo
CreateJobSet
GetProfileStringW
PeekConsoleInputA
SetTermsrvAppInstallMode
SetFileShortNameA
WriteConsoleOutputCharacterA
_lwrite
FreeConsole
IsValidLanguageGroup
EnumSystemLanguageGroupsW
CreateDirectoryExW
VirtualQueryEx
GetCurrencyFormatW
GetConsoleSelectionInfo
LoadLibraryA
UnhandledExceptionFilter
DnsHostnameToComputerNameW
ExpungeConsoleCommandHistoryW
GetThreadPriorityBoost
GetProcessTimes
SetComputerNameA
GetVolumePathNameW
EnumDateFormatsExA
VirtualQuery
CreateWaitableTimerW
EnumResourceTypesW
SetFileApisToOEM
SetConsoleWindowInfo
OutputDebugStringW
EnumSystemCodePagesA
GetLocaleInfoW
GetProcAddress
_lopen
CreateTimerQueueTimer
IsSystemResumeAutomatic
lstrcpynW
GetPrivateProfileIntA
VirtualAlloc
VerSetConditionMask
inetmib1
SnmpExtensionInitEx
SnmpExtensionInit
SnmpExtensionTrap
SnmpExtensionQuery
crtdll
atexit
realloc
iswalnum
fgets
_ismbckata
remove
_popen
__argv_dll
ctime
_cpumode_dll
vprintf
_rotl
_fputwchar
_mbsdup
modf
wcscmp
wscanf
_statusfp
_cputs
_mbsncpy
_ismbblead
fsetpos
_chsize
_mbbtype
_ismbbalnum
_endthread
bsearch
vsprintf
_itow
_wcsdup
_setsystime
div
_wcslwr
_ltoa
fopen
fread
atan2
_purecall
_tell
_mbschr
_vsnwprintf
_CIlog10
difftime
wow32
WOWGlobalUnlockFree16
WOWGlobalAlloc16
WOW32ResolveHandle
WOW32DriverCallback
WOW32ResolveMemory
CopyDropFilesFrom16
WOWGetVDMPointer
WOWGlobalLockSize16
GetCommShadowMSR
WOWGetVDMPointerFix
WOWGlobalAllocLock16
WOWUseMciavi16
WOWGlobalLock16
WOWYield16
WOWCallback16
CopyDropFilesFrom32
GetCommHandle
WOWGlobalUnlock16
WOWDirectedYield16
WOWFreeMetafile
WOWCallback16Ex
WOWHandle16
W32Dispatch
WOWGlobalFree16
W32HungAppNotifyThread
WOWGetVDMPointerUnfix
WOWHandle32
W32Init
dhcpsapi
DhcpGetServerBindingInfo
DhcpGetThreadOptions
DhcpCreateOption
DhcpSetClientInfo
DhcpEnumSubnetElementsV5
DhcpEnumSubnetClientsV4
DhcpRemoveSubnetElementV4
DhcpGetClientInfoV4
DhcpGetOptionInfo
DhcpDeleteMClientInfo
DhcpSetSuperScopeV4
DhcpScanDatabase
DhcpSetClientInfoV4
DhcpEnumSubnetClientsV5
DhcpAuditLogSetParams
DhcpDeleteClass
DhcpEnumClasses
DhcpRemoveMScopeElement
DhcpRpcFreeMemory
DhcpServerGetConfig
DhcpModifyClass
DhcpRemoveSubnetElement
DhcpCreateClass
DhcpEnumMScopes
DhcpEnumServers
netapi32
NetStatisticsGet
I_BrowserQueryStatistics
NetUseGetInfo
DsGetDcNameWithAccountW
DsAddressToSiteNamesExA
DsRoleFreeMemory
I_BrowserDebugTrace
I_NetDatabaseRedo
NetGroupDel
NetErrorLogClear
NetpwNameValidate
DsGetDcOpenA
NetReplExportDirLock
I_NetLogonSendToSam
DsRoleServerSaveStateForUpgrade
DsGetDcSiteCoverageW
NetpDbgPrint
NetGroupAddUser
NetEnumerateComputerNames
NetDfsAddStdRoot
NetServerEnumEx
I_NetAccountDeltas
I_NetGetDCList
NetGroupGetInfo
NetScheduleJobDel
NetGetJoinableOUs
I_NetDatabaseSync
NetGetDisplayInformationIndex
NetReplImportDirEnum
NetSetPrimaryComputerName
NetAuditRead
imm32
ImmIMPGetIMEA
ImmWINNLSGetEnableStatus
ImmGetIMEFileNameW
ImmUnlockClientImc
ImmGetDescriptionA
ImmSetConversionStatus
ImmIsUIMessageW
ImmGetConversionListW
ImmRequestMessageW
ImmLockImeDpi
ImmGetCandidateListA
ImmInstallIMEA
ImmAssociateContextEx
ImmReleaseContext
ImmConfigureIMEA
ImmNotifyIME
ImmSetCompositionStringA
ImmReSizeIMCC
ImmDestroyIMCC
ImmGetConversionStatus
ImmDisableIme
ImmRequestMessageA
ImmCreateSoftKeyboard
ImmGetIMEFileNameA
ImmSetCompositionFontW
ImmWINNLSEnableIME
ImmLockIMCC
ImmGetCandidateListCountA
ImmGetIMCCLockCount
ImmSimulateHotKey
ImmSetCandidateWindow
ImmUnlockIMC
ImmActivateLayout
mfc40
DllGetClassObject
Sections
.text Size: 379KB - Virtual size: 379KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 174KB - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 313KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ