Static task
static1
Behavioral task
behavioral1
Sample
051c59bba8dea3463816c8e632103bb1_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
051c59bba8dea3463816c8e632103bb1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
051c59bba8dea3463816c8e632103bb1_JaffaCakes118
-
Size
1.9MB
-
MD5
051c59bba8dea3463816c8e632103bb1
-
SHA1
0b61f7727b5202d9f354ec3a7fbe90035081275e
-
SHA256
09e4fdf0aae5cc3acc327e73233024148c469524339c3a25d4294a09654369df
-
SHA512
c75885da7a3b750f42b6a1dba20a63ca1c998aa67f21348abcade889eaf8fed94f89df35247c3a9575c7d1f306dd83d812519a6f81db240afd13d8cd0346835d
-
SSDEEP
49152:gQVciXKF4p+QFkS/10F7asQhzhp3Txk3KRdIJu+aHqn5+6itcZUMQeU3Tb/j9FwV:gQVFKQFkm1+7asQB3Y3
Malware Config
Signatures
Files
-
051c59bba8dea3463816c8e632103bb1_JaffaCakes118.exe windows:5 windows x86 arch:x86
fe417b5bbb9791bbb3fb9aee1741bfe7
Code Sign
59:35:01:54:12:12:df:a4:f8:7e:bf:92:9b:d9:08:d1:86:58:6d:ccSigner
Actual PE Digest59:35:01:54:12:12:df:a4:f8:7e:bf:92:9b:d9:08:d1:86:58:6d:ccDigest Algorithmsha1PE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
e:\wangguotao\chrome21\src\build\Release\chrome_exe.pdb
Imports
shlwapi
PathGetDriveNumberW
StrStrIW
PathFindFileNameW
SHGetValueA
SHGetValueW
PathFindFileNameA
PathFileExistsW
PathRemoveFileSpecW
kernel32
InterlockedIncrement
InterlockedDecrement
VirtualFreeEx
VirtualProtectEx
CreateFileW
GetLongPathNameW
GetFileAttributesW
QueryDosDeviceW
CreateJobObjectW
CreateMutexW
CreateNamedPipeW
OpenEventW
OpenProcess
SearchPathW
GetCurrentDirectoryW
DebugBreak
lstrlenW
VirtualQuery
ReadProcessMemory
SuspendThread
ReleaseSemaphore
RtlCaptureContext
MultiByteToWideChar
WideCharToMultiByte
VirtualAlloc
lstrlenA
GetTempFileNameW
GetTempPathW
DeleteFileW
WaitForMultipleObjects
WriteFile
SystemTimeToFileTime
SetEndOfFile
ReadFile
SetFilePointer
TlsFree
TlsAlloc
TlsSetValue
IsBadWritePtr
IsBadReadPtr
SetFileTime
SetWaitableTimer
CreateWaitableTimerW
GetDiskFreeSpaceExW
CancelWaitableTimer
SetEnvironmentVariableW
GetUserDefaultLangID
QueryPerformanceCounter
GetSystemTimeAsFileTime
TzSpecificLocalTimeToSystemTime
QueryPerformanceFrequency
FormatMessageA
ReleaseMutex
GetFileSize
UnmapViewOfFile
GetExitCodeProcess
FindNextFileW
GetFileTime
ExpandEnvironmentStringsW
GetUserDefaultLCID
IsDebuggerPresent
RaiseException
GetNativeSystemInfo
VirtualQueryEx
FindResourceW
LoadResource
SizeofResource
LockResource
lstrcmpA
lstrcmpiA
DeviceIoControl
InterlockedExchangeAdd
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
GetWindowsDirectoryW
FlushFileBuffers
AssignProcessToJobObject
GetStdHandle
GetSystemInfo
TlsGetValue
RtlCaptureStackBackTrace
WTSGetActiveConsoleSessionId
LocalAlloc
LoadLibraryA
UnhandledExceptionFilter
HeapFree
ExitProcess
GetStartupInfoW
HeapAlloc
ExitThread
GetConsoleCP
GetConsoleMode
HeapReAlloc
SetStdHandle
GetFileType
GetProcessHeap
LCMapStringA
LCMapStringW
GetCPInfo
RtlUnwind
GetStringTypeW
HeapCreate
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoA
GetStringTypeA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
CreateFileA
CompareStringA
CompareStringW
VirtualAllocEx
CreateFileMappingW
MapViewOfFile
WriteProcessMemory
FreeLibrary
ResumeThread
LocalFree
GetThreadLocale
VirtualFree
GetProcessHandleCount
SetHandleInformation
SignalObjectAndWait
InterlockedExchange
GetProcessId
RegisterWaitForSingleObject
DeleteCriticalSection
CreateIoCompletionPort
CreateEventW
CreateThread
GetCurrentThreadId
DuplicateHandle
ResetEvent
GetQueuedCompletionStatus
SetEvent
GetUserDefaultUILanguage
GetThreadContext
UnregisterWaitEx
TerminateJobObject
InitializeCriticalSection
GetLastError
SetLastError
PostQueuedCompletionStatus
WaitForSingleObject
SetInformationJobObject
LeaveCriticalSection
EnterCriticalSection
GetTickCount
GetModuleHandleW
FreeResource
GetModuleHandleA
SetCurrentDirectoryW
LoadLibraryExW
GetPrivateProfileIntW
WritePrivateProfileStringW
FindFirstFileW
FindClose
GetVersionExW
GetCurrentProcessId
GetEnvironmentVariableA
SetEnvironmentVariableA
LoadLibraryW
GetProcAddress
GetModuleFileNameW
SetErrorMode
GetEnvironmentVariableW
GetCommandLineW
CreateProcessW
CloseHandle
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
CreateRemoteThread
user32
MessageBoxW
GetDesktopWindow
CloseWindowStation
SetForegroundWindow
wsprintfW
ShowWindow
CharUpperW
GetUserObjectInformationW
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
GetProcessWindowStation
CreateWindowStationW
CloseDesktop
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetTraceLoggerHandle
GetTraceEnableFlags
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegQueryInfoKeyW
SetEntriesInAclW
GetSecurityInfo
CreateWellKnownSid
CopySid
LookupPrivilegeValueW
GetTokenInformation
EqualSid
DuplicateToken
DuplicateTokenEx
CreateRestrictedToken
RegCreateKeyExW
CreateProcessAsUserW
SetThreadToken
OpenProcessToken
ConvertStringSidToSidW
GetLengthSid
SetTokenInformation
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
RevertToSelf
RegDisablePredefinedCache
UnregisterTraceGuids
GetTraceEnableLevel
RegisterTraceGuidsW
SetFileSecurityW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetFileSecurityW
TraceEvent
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
wtsapi32
WTSQueryUserToken
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
timeGetTime
Exports
Exports
CrashForException
DumpProcess
DumpProcessWithoutCrash
InjectDumpProcessWithoutCrash
SetActiveURL
SetClientId
SetCommandLine2
SetExperimentList2
SetExtensionID
SetGpuInfo
SetNumberOfExtensions
SetNumberOfViews
SetPrinterInfo
Sections
.text Size: 806KB - Virtual size: 805KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 682KB - Virtual size: 681KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 537KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 323KB - Virtual size: 323KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ