Static task
static1
Behavioral task
behavioral1
Sample
0b49f4df28f8a52d625d718f6d45bf16_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b49f4df28f8a52d625d718f6d45bf16_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0b49f4df28f8a52d625d718f6d45bf16_JaffaCakes118
-
Size
361KB
-
MD5
0b49f4df28f8a52d625d718f6d45bf16
-
SHA1
610a94ad338ca600bd28a989094b443656e9a431
-
SHA256
929b6196ee46c8559afc334a6909a627d489d29ce3a88802aaa252a2a7fee43e
-
SHA512
3135c8df6baa6e98e735e3773fac99a3ec115f570ededc8a8b0cfa60fda3857f087199e5529a506d036c5dc10b4c5e11291d226426e276d0e504058b9447559f
-
SSDEEP
6144:YX0s5rt0KIX5C0f6YjolcF6JBf32UmEI+QMCZgp1rZaoa2MyL5tYNeFk2pN:Yks5hUv6YElcg32UmEI9MCorZaoa2MyL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b49f4df28f8a52d625d718f6d45bf16_JaffaCakes118
Files
-
0b49f4df28f8a52d625d718f6d45bf16_JaffaCakes118.exe windows:4 windows x86 arch:x86
1141accdbfb93bb234b4b388a48d8596
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegSetValueA
SetNamedSecurityInfoExW
LogonUserW
SetNamedSecurityInfoA
CryptDestroyHash
GetNamedSecurityInfoA
CryptEnumProvidersA
CryptEnumProviderTypesA
SetNamedSecurityInfoW
CryptSignHashW
StartServiceCtrlDispatcherW
ImpersonateLoggedOnUser
GetAce
IsTextUnicode
DestroyPrivateObjectSecurity
AreAllAccessesGranted
ClearEventLogW
GetSecurityInfo
BuildExplicitAccessWithNameA
ObjectDeleteAuditAlarmW
CryptAcquireContextW
IsValidSecurityDescriptor
GetNumberOfEventLogRecords
BuildImpersonateTrusteeW
RegFlushKey
RegEnumValueW
LookupPrivilegeDisplayNameW
AdjustTokenGroups
GetAuditedPermissionsFromAclW
GetMultipleTrusteeW
OpenEventLogA
ConvertAccessToSecurityDescriptorW
BuildTrusteeWithSidA
EnumServicesStatusA
RegSetValueW
SetSecurityDescriptorGroup
CryptImportKey
AreAnyAccessesGranted
GetAuditedPermissionsFromAclA
FindFirstFreeAce
CryptDuplicateKey
RegCreateKeyExW
GetLengthSid
CryptDeriveKey
EqualSid
SetFileSecurityA
RegQueryValueExA
SetSecurityInfoExW
GetTrusteeTypeW
CryptReleaseContext
ObjectCloseAuditAlarmA
GetKernelObjectSecurity
GetFileSecurityA
BuildSecurityDescriptorA
RegLoadKeyA
OpenServiceA
BuildImpersonateTrusteeA
InitializeSecurityDescriptor
LookupAccountSidW
AdjustTokenPrivileges
CryptHashData
SetEntriesInAclA
RegEnumValueA
SetNamedSecurityInfoExA
InitializeSid
GetPrivateObjectSecurity
CancelOverlappedAccess
CryptEncrypt
ConvertAccessToSecurityDescriptorA
EnumDependentServicesW
CryptGetHashParam
ChangeServiceConfigW
RegQueryMultipleValuesA
GetServiceKeyNameW
SetEntriesInAuditListW
PrivilegedServiceAuditAlarmW
GetTokenInformation
CryptHashSessionKey
GetServiceKeyNameA
RegisterEventSourceW
ConvertSecurityDescriptorToAccessW
GetSecurityDescriptorControl
ObjectOpenAuditAlarmA
GetOldestEventLogRecord
CryptSetProvParam
FreeSid
RegSetValueExA
AccessCheckAndAuditAlarmA
GetServiceDisplayNameW
CryptGetDefaultProviderW
RegDeleteKeyW
BuildSecurityDescriptorW
MapGenericMask
CloseServiceHandle
UnlockServiceDatabase
CryptDuplicateHash
SetSecurityDescriptorSacl
CryptSetProviderExW
AddAce
BuildTrusteeWithNameA
AbortSystemShutdownW
EnumServicesStatusW
AllocateLocallyUniqueId
GetSecurityDescriptorGroup
SetKernelObjectSecurity
RegRestoreKeyW
LockServiceDatabase
OpenBackupEventLogW
InitiateSystemShutdownA
CryptEnumProviderTypesW
CryptSetProviderW
ImpersonateSelf
ObjectCloseAuditAlarmW
SetSecurityDescriptorOwner
BackupEventLogW
PrivilegedServiceAuditAlarmA
GetCurrentHwProfileA
CryptSetProviderA
RegCreateKeyW
RegQueryInfoKeyA
GetServiceDisplayNameA
IsValidAcl
AddAccessDeniedAce
CryptVerifySignatureA
OpenEventLogW
DeregisterEventSource
SetServiceStatus
ole32
CoGetStandardMarshal
RegisterDragDrop
CoSwitchCallContext
StgGetIFillLockBytesOnFile
PropVariantCopy
ReadStringStream
OleConvertIStorageToOLESTREAMEx
CoRevokeClassObject
OleDestroyMenuDescriptor
OleDoAutoConvert
OleCreateFromData
ReadClassStm
ProgIDFromCLSID
CoQueryClientBlanket
SetConvertStg
MkParseDisplayName
CoRegisterClassObject
OleMetafilePictFromIconAndLabel
WriteClassStg
CreateDataCache
OleCreateDefaultHandler
CoGetPSClsid
CoGetInstanceFromIStorage
IIDFromString
CoGetObject
UtGetDvtd16Info
GetClassFile
CoRegisterMessageFilter
CoLockObjectExternal
OleInitialize
OleDuplicateData
StgOpenAsyncDocfileOnIFillLockBytes
CreateILockBytesOnHGlobal
CLSIDFromString
CreateFileMoniker
CoFreeAllLibraries
CoCreateFreeThreadedMarshaler
GetHookInterface
WriteOleStg
CoSetProxyBlanket
CoLoadLibrary
OleCreateLinkToFileEx
CoRegisterSurrogate
OleCreateLinkToFile
CoImpersonateClient
WriteClassStm
CoAddRefServerProcess
OleGetIconOfClass
DllDebugObjectRPCHook
StgOpenStorageEx
CoGetClassObject
OleDraw
OleRegGetUserType
CoGetCallerTID
CoCopyProxy
OleConvertOLESTREAMToIStorage
CoGetCurrentLogicalThreadId
CreateStreamOnHGlobal
StringFromCLSID
OleGetIconOfFile
StgIsStorageFile
OleGetAutoConvert
StgOpenStorage
CreatePointerMoniker
OleIsRunning
StringFromGUID2
CoGetInstanceFromFile
CoQueryReleaseObject
CoCreateGuid
CoIsOle1Class
CoCreateInstanceEx
RevokeDragDrop
UpdateDCOMSettings
CoIsHandlerConnected
CreateDataAdviseHolder
CoFileTimeToDosDateTime
CoUninitialize
CoInitializeSecurity
WriteStringStream
CoTreatAsClass
CoSuspendClassObjects
CoReleaseMarshalData
StgGetIFillLockBytesOnILockBytes
PropVariantClear
UtConvertDvtd16toDvtd32
CoQueryProxyBlanket
OleConvertIStorageToOLESTREAM
OleCreateLinkEx
CoDosDateTimeToFileTime
CoRegisterPSClsid
UtGetDvtd32Info
CreateItemMoniker
CoFileTimeNow
StgCreateStorageEx
CoInitialize
OleSetClipboard
StgSetTimes
OleBuildVersion
OleRegGetMiscStatus
StgIsStorageILockBytes
DoDragDrop
CoTaskMemAlloc
CreateObjrefMoniker
OleCreateEx
CoFreeLibrary
CoUnmarshalInterface
CoDisconnectObject
kernel32
GetExitCodeProcess
IsValidLocale
BackupWrite
QueryDosDeviceW
SetConsoleWindowInfo
SetConsoleCursorPosition
SetDefaultCommConfigA
GlobalGetAtomNameW
MoveFileExA
SizeofResource
CreateFileMappingW
TransmitCommChar
IsValidCodePage
GetNamedPipeHandleStateA
GetConsoleCursorInfo
SetHandleCount
ReadConsoleOutputA
MoveFileW
ExpandEnvironmentStringsW
GetCommConfig
GetThreadContext
TlsFree
GetConsoleScreenBufferInfo
HeapUnlock
GetAtomNameA
SetConsoleCP
IsBadWritePtr
WriteFileEx
SetEndOfFile
GlobalAlloc
ResetEvent
SetCalendarInfoA
GetLargestConsoleWindowSize
GetProcessWorkingSetSize
GlobalDeleteAtom
EnumResourceNamesA
IsBadHugeWritePtr
GetVolumeInformationA
ScrollConsoleScreenBufferW
WriteProfileStringA
SetThreadExecutionState
LocalLock
WritePrivateProfileStringW
GetPrivateProfileIntW
FoldStringW
LocalReAlloc
VirtualAlloc
FindNextChangeNotification
IsProcessorFeaturePresent
GetTimeFormatW
MapViewOfFile
lstrcpyA
FreeEnvironmentStringsW
EnumCalendarInfoA
DebugBreak
GetShortPathNameW
SetCommState
ReadConsoleOutputCharacterW
GetSystemDirectoryA
GetShortPathNameA
GetConsoleTitleW
OpenSemaphoreA
GetDriveTypeW
SetConsoleActiveScreenBuffer
GetCalendarInfoW
LocalFree
lstrcmpA
PeekConsoleInputW
SetThreadPriority
GetNamedPipeHandleStateW
ReadDirectoryChangesW
ScrollConsoleScreenBufferA
GetFileAttributesA
LocalSize
WideCharToMultiByte
EscapeCommFunction
VirtualProtect
GlobalFix
SetFileApisToANSI
GetEnvironmentStringsW
GlobalWire
EnumSystemLocalesA
ContinueDebugEvent
GetProcessHeaps
lstrcmp
FatalAppExitW
SetConsoleCtrlHandler
GetCurrentDirectoryA
LockFile
SetThreadContext
GetDefaultCommConfigA
GetCPInfoExA
FillConsoleOutputCharacterA
GetProfileStringW
FlushConsoleInputBuffer
SetMessageWaitingIndicator
OpenMutexA
SetLocaleInfoA
GetEnvironmentVariableA
CompareFileTime
IsBadStringPtrA
GetFileType
FreeLibraryAndExitThread
GetLogicalDrives
FormatMessageA
ReadConsoleOutputAttribute
FileTimeToLocalFileTime
LoadLibraryA
GetPrivateProfileSectionW
FindFirstChangeNotificationA
GetSystemDirectoryW
GlobalFindAtomW
Beep
SetNamedPipeHandleState
AddAtomW
SetWaitableTimer
VerLanguageNameA
EnumResourceTypesA
ReadConsoleA
CreateWaitableTimerA
CallNamedPipeW
DefineDosDeviceW
LocalAlloc
SetFileTime
TlsAlloc
SetCommConfig
SetEvent
SystemTimeToTzSpecificLocalTime
ReadFileScatter
GetTimeZoneInformation
FreeResource
SetHandleInformation
GetTempPathW
CreateFileW
HeapLock
CopyFileExA
CreateProcessA
GetPrivateProfileSectionA
EnumCalendarInfoW
GetTempPathA
ReleaseSemaphore
UpdateResourceW
SearchPathA
DisconnectNamedPipe
ReadConsoleInputA
GetBinaryType
shlwapi
SHRegGetUSValueA
StrRetToBufA
SHRegDeleteUSValueW
SHStrDupW
PathRelativePathToW
PathMakePrettyA
StrRetToBufW
SHGetValueW
SHCreateStreamOnFileA
SHRegEnumUSValueW
SHRegDeleteUSValueA
UrlIsOpaqueW
PathIsRootW
PathUnmakeSystemFolderW
SHRegEnumUSKeyW
StrRetToStrW
PathAddExtensionW
PathCommonPrefixA
SHSetValueA
PathCreateFromUrlW
PathIsLFNFileSpecW
PathCompactPathExA
UrlIsW
SHDeleteKeyW
PathSearchAndQualifyW
StrFormatByteSizeA
IntlStrEqWorkerA
SHAutoComplete
StrCatBuffW
SHRegDuplicateHKey
UrlGetPartA
PathMakeSystemFolderW
PathIsFileSpecW
StrToIntExW
StrTrimW
SHOpenRegStream2A
PathIsRootA
StrRChrA
PathUnquoteSpacesA
PathSkipRootA
SHRegQueryInfoUSKeyW
UrlCreateFromPathA
StrRetToStrA
SHRegQueryInfoUSKeyA
SHRegCreateUSKeyW
SHQueryInfoKeyA
StrCSpnW
SHGetValueA
StrCmpW
SHDeleteKeyA
StrCmpNIW
SHRegDeleteEmptyUSKeyA
UrlApplySchemeW
StrDupA
UrlIsOpaqueA
PathIsUNCServerW
SHOpenRegStreamA
PathRemoveBackslashA
PathAddBackslashA
ColorRGBToHLS
PathSearchAndQualifyA
PathBuildRootW
StrStrIA
PathIsDirectoryA
PathAddExtensionA
UrlEscapeA
StrRStrIW
StrDupW
SHRegWriteUSValueW
UrlCompareA
SHSetThreadRef
PathFindNextComponentW
PathRelativePathToA
SHDeleteValueW
PathIsUNCServerShareA
SHRegEnumUSKeyA
PathCompactPathExW
PathIsURLW
PathCombineA
PathGetDriveNumberA
PathBuildRootA
PathRemoveFileSpecW
PathMatchSpecW
PathIsContentTypeA
PathIsDirectoryEmptyW
SHRegEnumUSValueA
PathCombineW
StrPBrkA
UrlApplySchemeA
UrlCreateFromPathW
SHGetInverseCMAP
StrChrW
PathParseIconLocationA
StrCmpNIA
PathRemoveArgsA
StrToIntA
ColorAdjustLuma
AssocQueryStringByKeyA
StrSpnW
user32
GetMessageExtraInfo
UnregisterClassA
CheckDlgButton
SwitchDesktop
SetClassLongW
IsDialogMessageA
GetMenuItemInfoW
GetLastActivePopup
EndTask
CharLowerW
VkKeyScanW
GetWindow
GetUserObjectInformationW
InsertMenuItemA
EnumDisplaySettingsExA
GetWindowContextHelpId
CreateWindowStationW
GetKeyboardLayout
GetWindowThreadProcessId
GetWindowTextA
CopyAcceleratorTableW
GrayStringW
EnumDisplaySettingsA
SetForegroundWindow
IsCharAlphaNumericA
CreateAcceleratorTableW
DispatchMessageW
GetDlgItem
EnumDisplaySettingsW
GetMenuDefaultItem
GetMenuItemCount
IsDialogMessageW
RegisterClassExW
GetClipboardOwner
PeekMessageW
GetTopWindow
PostMessageW
CharNextA
SetWindowsHookW
AppendMenuW
GetKeyboardLayoutList
RegisterClassW
FindWindowA
GetScrollBarInfo
GetMenuCheckMarkDimensions
SetScrollPos
GetTitleBarInfo
EmptyClipboard
TileChildWindows
GetDialogBaseUnits
DragDetect
RedrawWindow
GetSystemMetrics
IsCharUpperW
GetClassNameA
DlgDirSelectComboBoxExA
CallWindowProcW
EnumPropsW
InflateRect
WINNLSEnableIME
OpenWindowStationA
DefMDIChildProcW
UnregisterHotKey
GetUserObjectSecurity
SetCursor
MapWindowPoints
CreateMenu
CheckMenuItem
ShowWindowAsync
GetMenuItemID
UnhookWindowsHookEx
EnumWindowStationsA
EndPaint
UnpackDDElParam
SetCaretPos
SetProcessWindowStation
GetSubMenu
CreateMDIWindowA
MapDialogRect
DdeUnaccessData
GetWindowTextLengthA
DdeQueryNextServer
IsRectEmpty
DialogBoxIndirectParamA
RealChildWindowFromPoint
TileWindows
PaintDesktop
ScrollWindow
EnumDesktopsW
VkKeyScanExA
ScrollDC
SetClassLongA
GetClassNameW
InSendMessageEx
SwapMouseButton
CharNextW
GetScrollInfo
EndDeferWindowPos
SetWindowLongW
GetKBCodePage
CountClipboardFormats
DdeCmpStringHandles
LoadMenuIndirectA
ShowCursor
TranslateAccelerator
LoadAcceleratorsW
GetCursor
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 86B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE