Behavioral task
behavioral1
Sample
1521fd02bc03bdc7228cf23a4100588d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1521fd02bc03bdc7228cf23a4100588d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
1521fd02bc03bdc7228cf23a4100588d_JaffaCakes118
-
Size
648KB
-
MD5
1521fd02bc03bdc7228cf23a4100588d
-
SHA1
3910f918b78094e2d33fe0685b59c128a1091c10
-
SHA256
3ae3656938572bd93a2092addd8c4085bc09f106a51f9302bbcec6e7edfa45de
-
SHA512
d3468b105c822d62bab00c7a9e8e9a4738006f3ea1fffff1017702281461be5dc43cfc3d74354872f47ddfcb984a4f5a36d22ccaed8d7d72dd05c6e7618b2e11
-
SSDEEP
12288:qaA9OKLSwaIN5U8xvFoRQMEoO2rx8ikfRtjIe9rtv8zl6Oilg6:+kK+waI8JRQMEJ2rufRtse9rtv8zlViz
Malware Config
Signatures
-
AmmyyAdmin payload 1 IoCs
resource yara_rule sample family_ammyyadmin -
Ammyyadmin family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1521fd02bc03bdc7228cf23a4100588d_JaffaCakes118
Files
-
1521fd02bc03bdc7228cf23a4100588d_JaffaCakes118.exe windows:4 windows x86 arch:x86
ffb5ae016ce323172126d82e6bfb166f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSAGetLastError
send
recv
shutdown
__WSAFDIsSet
accept
bind
listen
ioctlsocket
getservbyport
ntohs
gethostbyaddr
gethostbyname
getservbyname
htonl
inet_ntoa
inet_addr
socket
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
select
closesocket
gdi32
SetPixelV
GetSystemPaletteEntries
GetDIBits
GdiFlush
CombineRgn
CreateRectRgnIndirect
GetRegionData
SetStretchBltMode
CreateFontIndirectA
DPtoLP
GetDeviceCaps
GetStockObject
SetBkMode
SetBitmapBits
CreateDIBSection
DeleteDC
SetBrushOrgEx
StretchBlt
BitBlt
UpdateColors
SelectPalette
RealizePalette
CreateCompatibleBitmap
CreatePalette
CreateRectRgn
SelectClipRgn
SetBkColor
ExtTextOutA
GetBitmapBits
GetObjectA
SelectObject
SetTextColor
DeleteObject
CreateCompatibleDC
user32
FindWindowA
VkKeyScanExA
MapVirtualKeyA
GetIconInfo
SendMessageTimeoutA
SystemParametersInfoW
IntersectRect
EqualRect
OpenInputDesktop
GetUserObjectInformationA
DefWindowProcA
IsWindowVisible
EmptyClipboard
SetClipboardData
DrawIconEx
RegisterClassExA
OpenDesktopA
EnumDesktopWindows
CloseDesktop
GetDesktopWindow
MsgWaitForMultipleObjects
PeekMessageA
mouse_event
GetThreadDesktop
GetMessageA
SetTimer
MessageBoxA
wsprintfA
SetDlgItemTextA
ReleaseDC
SetThreadDesktop
keybd_event
GetCursorInfo
IsDialogMessageA
SetDlgItemInt
TranslateMessage
DispatchMessageA
GetKeyboardState
ToAsciiEx
LoadKeyboardLayoutA
DestroyAcceleratorTable
TranslateAcceleratorA
GetDC
SetDlgItemTextW
GetDlgItem
EnableWindow
EndDialog
LoadImageA
GetSubMenu
GetMenu
SetWindowLongA
CreateAcceleratorTableA
wsprintfW
ReleaseCapture
SetCapture
MoveWindow
GetAsyncKeyState
RegisterClassExW
DestroyCursor
MessageBeep
MessageBoxW
GetCursorPos
SetCursorPos
GetSystemMetrics
GetClipboardOwner
OpenClipboard
GetClipboardData
CloseClipboard
SetScrollInfo
GetFocus
GetWindow
WindowFromPoint
ScreenToClient
SetClassLongW
ChangeClipboardChain
PostQuitMessage
EnumWindows
GetClassNameA
GetWindowTextA
KillTimer
GetWindowLongW
SetRect
SetWindowPos
ShowScrollBar
IsIconic
ScrollWindowEx
SystemParametersInfoA
AdjustWindowRectEx
GetMenuState
GetWindowRect
GetWindowPlacement
SetWindowPlacement
GetSysColorBrush
RegisterClassW
DrawMenuBar
SetClipboardViewer
DrawTextA
DialogBoxIndirectParamA
DialogBoxParamA
CallWindowProcW
CallWindowProcA
DefWindowProcW
SetWindowLongW
IsWindowUnicode
GetSystemMenu
RedrawWindow
UpdateWindow
InvalidateRect
SendMessageW
CreateWindowExW
DrawStateA
DrawEdge
IsWindow
GetParent
DestroyWindow
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetActiveWindow
SetCursor
LoadCursorA
DestroyIcon
PostThreadMessageA
GetSysColor
CreateWindowExA
BeginPaint
EndPaint
PostMessageA
LoadIconA
GetKeyState
GetDlgItemInt
SendDlgItemMessageA
SetWindowTextW
SetMenuItemInfoW
GetMenuItemID
EnableMenuItem
GetMenuItemCount
CheckMenuItem
SetForegroundWindow
SetFocus
AppendMenuA
SetWindowTextA
ShowWindow
GetClientRect
SendMessageA
GetWindowLongA
shell32
ShellExecuteA
ShellExecuteExW
SHGetFileInfoW
SHGetFolderPathW
SHGetSpecialFolderPathW
Shell_NotifyIconA
msvcrt
_strnicmp
_strlwr
__CxxFrameHandler
strlen
isspace
memchr
_errno
strtol
isdigit
strstr
memcpy
??2@YAPAXI@Z
_purecall
_stricmp
_CxxThrowException
atol
memset
atoi
abs
sprintf
wcscmp
swprintf
wcscpy
_wtol
strcpy
iswspace
wcsncmp
wcslen
_wtoi
_ultow
wcschr
memcmp
strncpy
strchr
strcat
free
strtoul
calloc
strcmp
_ftol
wcsncpy
wcsrchr
vsprintf
vswprintf
memmove
strrchr
strncmp
mbstowcs
iswdigit
_beginthreadex
sscanf
_endthreadex
_i64tow
malloc
wcscat
time
srand
rand
exit
fprintf
_iob
getenv
floor
printf
realloc
fputc
_CIpow
_CIacos
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wcsrev
_wcsicmp
secur32
QuerySecurityPackageInfoA
FreeCredentialsHandle
InitializeSecurityContextA
AcquireCredentialsHandleA
FreeContextBuffer
CompleteAuthToken
setupapi
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiClassGuidsFromNameA
advapi32
ConvertSidToStringSidA
GetTokenInformation
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
FreeSid
SetFileSecurityW
SetSecurityDescriptorDacl
SetEntriesInAclA
AllocateAndInitializeSid
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerExA
SetServiceStatus
SetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
CreateServiceW
DeleteService
ControlService
StartServiceA
RegCreateKeyExA
RegQueryValueExW
RegSetValueExW
RegSetValueExA
RegDeleteKeyA
InitializeSecurityDescriptor
comdlg32
GetOpenFileNameW
GetSaveFileNameW
userenv
LoadUserProfileA
UnloadUserProfile
comctl32
CreateToolbarEx
ImageList_Draw
ImageList_Add
ImageList_Create
ord17
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_Destroy
_TrackMouseEvent
CreatePropertySheetPageW
PropertySheetW
wininet
HttpSendRequestA
HttpQueryInfoA
InternetConnectA
InternetSetOptionA
InternetCloseHandle
InternetReadFile
InternetOpenA
HttpOpenRequestA
dsound
ord7
ord6
ord2
ord1
kernel32
FindResourceExA
SizeofResource
LoadResource
LockResource
GetLocalTime
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
SetEvent
OpenEventA
CreateEventA
ExitProcess
SetUnhandledExceptionFilter
CompareFileTime
QueryPerformanceFrequency
GetSystemDirectoryW
lstrcatW
LoadLibraryW
WaitNamedPipeW
ReadFile
SetLastError
GetExitCodeProcess
BeginUpdateResourceW
QueryPerformanceCounter
UpdateResourceA
TerminateProcess
CreateMutexA
Sleep
GetSystemDirectoryA
OpenProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
LoadLibraryA
FreeLibrary
GetFileSize
SetFilePointer
WriteFile
WaitForSingleObject
CreateThread
GetStartupInfoW
CreateProcessW
GetVersion
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
LocalAlloc
GetExitCodeThread
SystemTimeToFileTime
MoveFileW
DeleteFileW
GetTempPathW
CreateFileW
FindFirstFileW
FindClose
GetUserDefaultUILanguage
GetModuleHandleA
GetProcAddress
GetLocaleInfoA
CreateFileA
DeviceIoControl
CreateDirectoryW
SetCurrentDirectoryW
SetProcessShutdownParameters
GetVersionExA
GetCurrentProcess
GetLastError
CloseHandle
LocalFree
GetCurrentThreadId
GetCurrentProcessId
GetTickCount
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrlenW
GlobalUnlock
GlobalLock
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
GetComputerNameA
GlobalAlloc
GetDriveTypeW
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
GetLogicalDrives
GetFileTime
SetFileTime
GlobalFree
CreateDirectoryA
IsBadReadPtr
lstrcmpA
LocalFileTimeToFileTime
EndUpdateResourceW
lstrcpyA
GetCurrentDirectoryA
FindResourceA
DuplicateHandle
ReleaseSemaphore
CreateSemaphoreA
SetThreadPriority
TlsSetValue
GetCurrentThread
TlsAlloc
ResumeThread
TlsGetValue
InterlockedExchange
GetStartupInfoA
GetSystemTimeAsFileTime
Sections
.text Size: 444KB - Virtual size: 443KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ