Static task
static1
Behavioral task
behavioral1
Sample
eb847bcc617ccb5668bf2cdf7b72838b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eb847bcc617ccb5668bf2cdf7b72838b_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
eb847bcc617ccb5668bf2cdf7b72838b_JaffaCakes118
-
Size
176KB
-
MD5
eb847bcc617ccb5668bf2cdf7b72838b
-
SHA1
8f488b56f6b071de13cce7556de9e409b898c3c2
-
SHA256
99d19c15428033d64a47e714a069a29b93513f59922786a391681feb328c3451
-
SHA512
79fd14315e2499c5fe2df1778b6b0a234e6664760bfa53531a2ee93263279d48b65fe257f277a46c0949244e92b7f23737b44e37f753da9ffe4b00dd230914cd
-
SSDEEP
3072:U4Xc8vzyygLt4phG6u6JumM3Mnbpx2STE0pC+/qfcb6ghroMBMPEhMgMI:U4s8ryR46G1Xw0M+Ucb64rhMTp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb847bcc617ccb5668bf2cdf7b72838b_JaffaCakes118
Files
-
eb847bcc617ccb5668bf2cdf7b72838b_JaffaCakes118.exe windows:5 windows x86 arch:x86
b1ac0438d1dbfc574a5f65918f700ed2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
lstrlenW
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
QueryDosDeviceW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
OpenProcess
ExitProcess
GetCommandLineW
SetErrorMode
GetComputerNameW
GetModuleFileNameW
ExitThread
GetModuleHandleA
GetFileAttributesExW
OpenEventW
DuplicateHandle
GetCurrentProcessId
GetThreadContext
SetThreadContext
GetProcessId
GetLocalTime
GetPrivateProfileStringW
GetPrivateProfileIntW
WTSGetActiveConsoleSessionId
SetHandleInformation
CreatePipe
GlobalLock
GlobalUnlock
MoveFileExW
GetUserDefaultUILanguage
GetNativeSystemInfo
CreateRemoteThread
Process32FirstW
Process32NextW
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetModuleHandleW
CreateDirectoryW
HeapFree
GetLogicalDriveStringsW
CreateFileW
GetTimeZoneInformation
ReadFile
Thread32Next
GetFileAttributesW
lstrcpynW
HeapCreate
HeapDestroy
ReadProcessMemory
Sleep
LoadLibraryW
VirtualFreeEx
WideCharToMultiByte
GetVersionExW
Thread32First
SetFilePointerEx
GetCurrentProcess
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
lstrcmpiW
LoadLibraryA
GetProcAddress
FreeLibrary
TlsFree
TlsAlloc
CreateFileMappingW
UnmapViewOfFile
WaitForSingleObject
MapViewOfFile
CreateMutexW
GetSystemTime
ReleaseMutex
GetCurrentThreadId
SetLastError
GetTickCount
ResetEvent
SetThreadPriority
TerminateProcess
TlsSetValue
GetCurrentThread
SetEvent
TlsGetValue
CloseHandle
WaitForMultipleObjects
CreateEventW
lstrcmpiA
user32
GetKeyboardState
GetSystemMetrics
OpenInputDesktop
OpenDesktopW
MenuItemFromPoint
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
GetClipboardData
HiliteMenuItem
RegisterClassW
CallWindowProcA
EndMenu
CallWindowProcW
DefFrameProcW
RegisterClassA
GetShellWindow
CharLowerW
GetMessageA
GetIconInfo
SetCapture
GetParent
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
ToUnicode
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenWindowStationW
DestroyWindow
LoadCursorW
ExitWindowsEx
CloseDesktop
LoadIconW
CreateWindowExA
ShowWindow
SetThreadDesktop
UpdateWindow
GetKeyboardLayoutList
MapVirtualKeyW
CharLowerBuffA
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
TranslateMessage
CharLowerA
SetWindowLongW
CharUpperW
GetWindow
DispatchMessageW
DefMDIChildProcA
DrawIcon
PeekMessageW
PeekMessageA
SetWindowPos
RegisterClassExA
RegisterWindowMessageW
GetThreadDesktop
GetCursorPos
SendMessageTimeoutW
IsWindow
ReleaseCapture
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
PostMessageW
GetWindowInfo
DrawEdge
BeginPaint
GetUpdateRect
GetDC
IntersectRect
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
GetWindowRect
DefFrameProcA
GetDCEx
ReleaseDC
PostThreadMessageW
EqualRect
PrintWindow
SendMessageW
DefWindowProcW
IsRectEmpty
GetUserObjectInformationW
advapi32
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
IsWellKnownSid
GetLengthSid
SetSecurityInfo
CreateProcessAsUserA
RegEnumKeyExW
EqualSid
InitiateSystemShutdownExW
ConvertSidToStringSidW
shlwapi
PathMatchSpecW
PathIsURLW
StrCmpNIW
StrStrIW
StrStrIA
PathRenameExtensionW
PathQuoteSpacesW
wvnsprintfA
StrCmpNIA
UrlUnescapeA
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
shell32
ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW
secur32
GetUserNameExW
ole32
CLSIDFromString
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateInstance
gdi32
RestoreDC
CreateCompatibleDC
SetRectRgn
SelectObject
DeleteObject
GdiFlush
DeleteDC
SetViewportOrgEx
CreateCompatibleBitmap
GetDeviceCaps
GetDIBits
CreateDIBSection
GetStockObject
SaveDC
ws2_32
select
getaddrinfo
recvfrom
getpeername
listen
send
closesocket
WSASetLastError
inet_addr
WSASend
gethostbyname
WSAIoctl
sendto
recv
freeaddrinfo
WSAEventSelect
getsockname
accept
bind
setsockopt
shutdown
WSAGetLastError
WSAStartup
connect
WSAAddressToStringW
socket
crypt32
CryptUnprotectData
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
wininet
InternetQueryOptionW
InternetCrackUrlA
InternetReadFile
InternetSetOptionA
InternetCloseHandle
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
HttpAddRequestHeadersA
InternetQueryOptionA
InternetConnectA
InternetOpenA
HttpSendRequestA
HttpQueryInfoA
HttpOpenRequestA
oleaut32
SysFreeString
VariantInit
SysAllocString
VariantClear
netapi32
NetUserEnum
NetApiBufferFree
NetUserGetInfo
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
winmm
waveOutGetVolume
PlaySoundA
PlaySoundW
waveOutSetVolume
Sections
.text Size: 166KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ