Static task
static1
Behavioral task
behavioral1
Sample
2c4fe8202eba1cd7c7087eae983d1752_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2c4fe8202eba1cd7c7087eae983d1752_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2c4fe8202eba1cd7c7087eae983d1752_JaffaCakes118
-
Size
156KB
-
MD5
2c4fe8202eba1cd7c7087eae983d1752
-
SHA1
8de0f6e7ae81f46962f7d47ef98efebddfb36b5b
-
SHA256
024f35738e83ea623eab4ce2523399fa1bda050ff40993cee2c6eee9acf6d659
-
SHA512
79a5dd45ca5d5f5fff84503f868cda9a80cb51326240acea299da76c4b35a2608db29334c23120550ce2c94a2090378bb64bb7d45d26be41d1a6f0e9c82786b0
-
SSDEEP
3072:aszPQa5svbUW7dAdk2PDVvAkFXkoESfxGYzieBnfbFzIBP3v6tSUn:5J5svbUQmdVAQ0oPGYzieBnfWzUn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c4fe8202eba1cd7c7087eae983d1752_JaffaCakes118
Files
-
2c4fe8202eba1cd7c7087eae983d1752_JaffaCakes118.exe windows:5 windows x86 arch:x86
ff472be294c421361d299da40c5f8158
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegEnumKeyExW
RegQueryInfoKeyW
OpenThreadToken
SetNamedSecurityInfoW
RegSetValueA
SetServiceStatus
SetThreadToken
RegOpenKeyA
StartServiceW
GetSecurityDescriptorLength
OpenServiceW
RegQueryValueW
RegOpenKeyW
GetSidSubAuthority
EqualSid
RegCreateKeyExA
GetTraceEnableLevel
GetLengthSid
RegDeleteKeyA
GetSecurityDescriptorOwner
CryptDestroyHash
RegCloseKey
LockServiceDatabase
CloseServiceHandle
ImpersonateLoggedOnUser
RegDeleteKeyW
GetSidIdentifierAuthority
InitializeSecurityDescriptor
ConvertStringSidToSidW
FreeSid
GetSecurityDescriptorDacl
GetUserNameW
IsValidSid
RegNotifyChangeKeyValue
AllocateAndInitializeSid
ChangeServiceConfigW
CryptAcquireContextW
GetTraceLoggerHandle
RegCreateKeyW
RegEnumKeyExA
RegSetValueExA
RegEnumKeyA
QueryServiceConfigW
GetAclInformation
CryptAcquireContextA
RegEnumKeyW
CheckTokenMembership
ConvertSidToStringSidW
RegQueryValueExW
SetSecurityDescriptorGroup
GetSecurityDescriptorControl
LsaFreeMemory
RegQueryInfoKeyA
GetUserNameA
IsValidSecurityDescriptor
CryptGenRandom
CryptReleaseContext
RegDeleteValueW
RegSetValueW
UnlockServiceDatabase
QueryServiceStatus
OpenSCManagerA
RegConnectRegistryW
RegQueryValueA
RegQueryValueExA
DuplicateTokenEx
LsaQueryInformationPolicy
SetSecurityDescriptorOwner
LookupPrivilegeValueA
CryptDestroyKey
RegOpenKeyExW
CryptGetHashParam
GetAce
OpenSCManagerW
RegCreateKeyA
GetTokenInformation
CryptCreateHash
LsaClose
GetTraceEnableFlags
RegOpenKeyExA
RegSetValueExW
RevertToSelf
RegisterTraceGuidsW
RegisterEventSourceW
LsaOpenPolicy
ConvertStringSecurityDescriptorToSecurityDescriptorW
UnregisterTraceGuids
RegFlushKey
CryptHashData
CopySid
AddAccessAllowedAce
MakeSelfRelativeSD
LookupAccountNameW
RegEnumValueW
LookupAccountSidW
ControlService
RegEnumValueA
RegCreateKeyExW
RegDeleteValueA
InitializeAcl
ReportEventW
SetSecurityDescriptorDacl
LookupPrivilegeValueW
OpenProcessToken
GetSidSubAuthorityCount
oleaut32
SafeArrayGetLBound
SysAllocStringByteLen
SafeArrayGetElement
VariantChangeType
SysReAllocStringLen
VariantCopy
SafeArrayAccessData
VariantClear
GetActiveObject
SafeArrayCreate
SafeArrayGetUBound
VariantCopyInd
SysFreeString
CreateErrorInfo
SetErrorInfo
SafeArrayPutElement
VariantInit
SafeArrayPtrOfIndex
VariantChangeTypeEx
SysStringByteLen
RegisterTypeLib
SysAllocStringLen
SysStringLen
LoadTypeLib
GetErrorInfo
SafeArrayUnaccessData
OleLoadPicture
version
GetFileVersionInfoA
VerQueryValueA
VerLanguageNameA
GetFileVersionInfoSizeW
VerQueryValueW
VerFindFileW
GetFileVersionInfoW
GetFileVersionInfoSizeA
shlwapi
wnsprintfA
PathAppendW
SHGetValueW
StrCpyNW
UrlCanonicalizeW
StrDupW
PathSkipRootW
PathAppendA
StrCatW
SHDeleteValueA
PathRemoveBlanksW
PathIsRootW
StrCatBuffW
PathRemoveExtensionW
PathRemoveBackslashW
PathAddBackslashW
PathCreateFromUrlW
StrCmpNW
PathIsURLW
UrlUnescapeW
StrToIntW
SHStrDupW
StrCmpNIA
PathIsUNCW
PathFindFileNameW
SHSetValueW
StrToIntExW
PathFindFileNameA
StrCpyW
PathFindExtensionA
StrRChrW
PathIsDirectoryW
UrlIsW
PathRemoveFileSpecW
StrStrW
PathStripToRootA
StrCmpNIW
StrChrIW
SHDeleteKeyA
AssocQueryStringW
StrTrimW
PathStripToRootW
SHRegGetBoolUSValueW
StrCmpW
StrChrW
SHDeleteKeyW
StrRetToBufW
wnsprintfW
PathCombineW
PathIsRelativeW
PathRemoveFileSpecA
StrStrIW
SHDeleteValueW
StrCmpIW
StrStrIA
PathFileExistsW
PathFindExtensionW
PathGetDriveNumberW
comctl32
InitCommonControls
PropertySheetA
InitCommonControlsEx
ImageList_Create
CreatePropertySheetPageW
ImageList_ReplaceIcon
ImageList_Destroy
PropertySheetW
ImageList_Draw
comdlg32
ChooseFontA
ChooseFontW
GetFileTitleW
FindTextW
GetFileTitleA
PrintDlgExW
ChooseColorA
FindTextA
CommDlgExtendedError
GetOpenFileNameA
GetSaveFileNameW
GetOpenFileNameW
ChooseColorW
GetSaveFileNameA
PageSetupDlgW
PrintDlgW
PageSetupDlgA
PrintDlgA
gdi32
BitBlt
GetPaletteEntries
UnrealizeObject
CreateBitmap
Rectangle
CreatePalette
StretchDIBits
GetClipBox
EndDoc
GetGlyphOutlineA
GetBkMode
DPtoLP
CreatePen
SetViewportOrgEx
SetStretchBltMode
SetBkMode
GetTextExtentPointW
SetMapMode
CreateSolidBrush
CreatePatternBrush
SelectClipRgn
OffsetRgn
GetRgnBox
StartPage
SetViewportExtEx
IntersectClipRect
GetStockObject
GetCurrentObject
CreateRectRgn
RealizePalette
RestoreDC
SetWindowOrgEx
GetBkColor
CreateCompatibleDC
CreateBrushIndirect
DeleteDC
GetTextAlign
ExtSelectClipRgn
GetViewportExtEx
PtVisible
OffsetViewportOrgEx
MoveToEx
EnumFontFamiliesExW
ScaleViewportExtEx
GetNearestColor
Ellipse
CreateCompatibleBitmap
TextOutA
GetDeviceCaps
SaveDC
ScaleWindowExtEx
LPtoDP
GetMapMode
Escape
TextOutW
SetBrushOrgEx
GetObjectW
SelectObject
CreateMetaFileA
CreateHalftonePalette
CreateFontA
SetWindowExtEx
SetTextAlign
RectVisible
GetSystemPaletteEntries
CloseMetaFile
GetTextExtentPoint32W
ExcludeClipRect
CreateDCW
GetTextColor
CreateDIBitmap
SelectPalette
GetTextMetricsA
SetTextColor
CreateDCA
SetROP2
CreateFontIndirectW
CreateMetaFileW
CreateDIBSection
ExtTextOutW
ExtTextOutA
SetBkColor
EndPage
PatBlt
DeleteObject
GetObjectA
TranslateCharsetInfo
GetPixel
CombineRgn
GetWindowExtEx
GetTextMetricsW
GetObjectType
GetBitmapBits
GetTextExtentPointA
GetDIBits
LineTo
ntdll
wcscat
DbgPrint
_strnicmp
RtlIntegerToUnicodeString
NtFsControlFile
RtlAppendUnicodeToString
RtlMultiByteToUnicodeN
RtlTimeToTimeFields
RtlFreeHeap
RtlCompareMemory
RtlRaiseStatus
RtlEqualSid
RtlQueueWorkItem
NtImpersonateAnonymousToken
RtlAdjustPrivilege
wcscmp
NtQueryPerformanceCounter
RtlxUnicodeStringToAnsiSize
strrchr
RtlOemToUnicodeN
RtlUnicodeToMultiByteSize
RtlRegisterWait
RtlAddAce
NtConnectPort
NtWaitForMultipleObjects
NtQueryDirectoryFile
RtlInitUnicodeString
RtlQueryEnvironmentVariable_U
NtSetSecurityObject
RtlCreateEnvironment
NtDeleteKey
NtQuerySystemInformation
wcsncat
NtSetValueKey
NtOpenFile
RtlGetDaclSecurityDescriptor
NtSetEvent
RtlValidSecurityDescriptor
RtlExpandEnvironmentStrings_U
atol
RtlLeaveCriticalSection
RtlDestroyHeap
RtlUpcaseUnicodeStringToOemString
RtlxOemStringToUnicodeSize
_stricmp
RtlDeleteElementGenericTable
_allmul
RtlClearBits
RtlOemStringToUnicodeString
RtlxUnicodeStringToOemSize
NtOpenProcess
RtlCreateUnicodeStringFromAsciiz
NtCreateEvent
RtlAddAccessAllowedAce
RtlUpcaseUnicodeChar
RtlPrefixUnicodeString
RtlAppendUnicodeStringToString
RtlGetAce
NtOpenDirectoryObject
RtlDeleteSecurityObject
RtlSetEnvironmentVariable
memmove
RtlOpenCurrentUser
RtlAcquireResourceExclusive
NtDelayExecution
NtDeleteValueKey
strncpy
RtlValidSid
RtlEnterCriticalSection
RtlUnicodeToOemN
RtlFreeSid
RtlTimeToSecondsSince1970
NtCreateKey
NtOpenProcessToken
NtQueryKey
wcscpy
RtlInsertElementGenericTable
RtlWriteRegistryValue
NtQuerySecurityObject
RtlCopyUnicodeString
RtlGetSaclSecurityDescriptor
_chkstk
RtlInitializeSid
RtlCompareUnicodeString
NtFreeVirtualMemory
RtlSubAuthoritySid
RtlAnsiStringToUnicodeString
RtlSetDaclSecurityDescriptor
NtWriteFile
VerSetConditionMask
RtlDeleteResource
RtlxAnsiStringToUnicodeSize
NtAllocateLocallyUniqueId
RtlUnicodeStringToAnsiString
RtlDestroyEnvironment
NtSetInformationFile
NtOpenThreadToken
NtEnumerateKey
NtDuplicateToken
RtlCreateUserThread
RtlMakeSelfRelativeSD
RtlGetFullPathName_U
NtSetInformationProcess
RtlGetOwnerSecurityDescriptor
NtTerminateProcess
RtlCopyLuid
NtQueryInformationThread
RtlInitializeCriticalSectionAndSpinCount
atoi
NtUnmapViewOfSection
_snwprintf
RtlStringFromGUID
NtSetInformationThread
RtlRunDecodeUnicodeString
wcschr
NtDuplicateObject
RtlCreateHeap
RtlUpcaseUnicodeString
NtMapViewOfSection
NtQueryAttributesFile
_wcslwr
user32
CharUpperA
GetWindowLongA
MessageBeep
SetWindowLongW
PtInRect
LoadStringA
ScreenToClient
IsDlgButtonChecked
GetDlgItemTextW
LoadIconA
ReleaseCapture
SendMessageW
DialogBoxParamA
DrawTextW
wsprintfW
DestroyWindow
GetCursorPos
RegisterClassExW
SetWindowTextA
UnhookWindowsHookEx
GetMessageW
CharPrevW
SendDlgItemMessageW
GetDlgCtrlID
GetMessagePos
SetWindowTextW
SendDlgItemMessageA
CheckDlgButton
SetDlgItemTextW
UpdateWindow
GetActiveWindow
CallNextHookEx
GetKeyState
GetSysColorBrush
GetClientRect
ExitWindowsEx
IntersectRect
InflateRect
FillRect
GetMenuItemCount
SystemParametersInfoA
TrackPopupMenu
GetWindowDC
GetWindowTextW
GetProcessWindowStation
SetWindowPos
IsIconic
GetWindowTextA
DispatchMessageA
CreatePopupMenu
SetDlgItemTextA
GetDlgItem
TranslateMessage
DestroyMenu
GetWindowRect
CreateWindowExA
GetClassNameW
SetTimer
GetWindowTextLengthW
PostMessageA
InvalidateRect
LoadStringW
MessageBoxW
SetForegroundWindow
GetSysColor
CharLowerW
GetMessageA
RegisterClassW
IsChild
SetFocus
DrawIcon
RegisterWindowMessageW
SetWindowLongA
EqualRect
IsWindowEnabled
WinHelpW
GetDesktopWindow
EnableWindow
MapWindowPoints
SetCapture
LoadImageW
SendMessageA
EnableMenuItem
GetWindowLongW
CreateWindowExW
DrawFocusRect
EndPaint
GetClassNameA
DrawTextA
LoadCursorW
GetParent
DestroyIcon
LoadBitmapW
LoadCursorA
PostMessageW
rpcrt4
NdrCStdStubBuffer_Release
RpcBindingSetAuthInfoExW
IUnknown_QueryInterface_Proxy
NdrServerCall2
RpcRevertToSelf
CStdStubBuffer_Disconnect
UuidToStringA
RpcStringBindingComposeW
NdrDllCanUnloadNow
CStdStubBuffer_DebugServerQueryInterface
RpcStringBindingParseW
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
RpcServerInqBindings
RpcServerRegisterIfEx
IUnknown_AddRef_Proxy
NdrStubCall2
CStdStubBuffer_DebugServerRelease
RpcBindingToStringBindingW
RpcBindingSetAuthInfoW
RpcServerUnregisterIf
RpcEpResolveBinding
NdrCStdStubBuffer2_Release
IUnknown_Release_Proxy
NdrOleAllocate
CStdStubBuffer_IsIIDSupported
NdrClientCall2
CStdStubBuffer_AddRef
UuidToStringW
CStdStubBuffer_QueryInterface
NdrStubForwardingFunction
NdrOleFree
CStdStubBuffer_CountRefs
NdrDllUnregisterProxy
NdrDllRegisterProxy
RpcRaiseException
RpcStringFreeW
UuidCreate
RpcImpersonateClient
RpcServerUseProtseqEpW
UuidFromStringW
RpcBindingFromStringBindingW
NdrDllGetClassObject
RpcBindingVectorFree
RpcServerRegisterAuthInfoW
RpcBindingFree
RpcStringFreeA
kernel32
CreateFileA
GetStringTypeW
WriteConsoleW
HeapFree
GetModuleFileNameA
lstrcatA
HeapCreate
GlobalAlloc
FreeLibrary
RaiseException
SetFileAttributesW
GetCurrentProcess
SystemTimeToFileTime
RtlUnwind
CompareStringW
GetLocaleInfoA
FindResourceW
CreateDirectoryW
GetComputerNameW
SetStdHandle
HeapSize
GetStringTypeA
FreeEnvironmentStringsA
LCMapStringA
SetUnhandledExceptionFilter
GetVersion
InitializeCriticalSection
GetStdHandle
LoadLibraryExA
TlsFree
GlobalLock
CloseHandle
lstrcpyA
LeaveCriticalSection
SetFileAttributesA
SetEvent
GetDriveTypeA
lstrlenA
GetExitCodeThread
LoadLibraryExW
SizeofResource
HeapReAlloc
GetSystemDirectoryW
GetEnvironmentStrings
UnhandledExceptionFilter
VirtualQuery
WaitForMultipleObjects
SetLastError
GetFileAttributesA
GetFileSize
MultiByteToWideChar
lstrcpyW
FindFirstFileW
GetFileAttributesW
IsBadReadPtr
QueryPerformanceCounter
ResumeThread
TlsAlloc
lstrcpynA
GetExitCodeProcess
IsDebuggerPresent
InterlockedIncrement
ReleaseMutex
CreateFileW
GetCommandLineA
GetProcessHeap
lstrcmpiW
GetSystemDirectoryA
ExpandEnvironmentStringsW
OpenMutexW
ReadFile
GetACP
HeapAlloc
TlsGetValue
CreateEventA
lstrcpynW
VirtualFree
GetLocalTime
InterlockedDecrement
LockResource
LoadResource
lstrcmpW
HeapDestroy
Sleep
CreateProcessA
GetLastError
GetLocaleInfoW
DeleteFileW
LocalAlloc
TlsSetValue
IsDBCSLeadByte
GetCurrentThread
WriteFile
EraseTape
lstrlenW
GetSystemTime
GetTempPathA
ExitProcess
UnmapViewOfFile
MapViewOfFile
GetUserDefaultLCID
EnterCriticalSection
OutputDebugStringW
CreateProcessW
CreateFileMappingW
InterlockedExchange
LocalFree
FindClose
GetSystemTimeAsFileTime
FindNextFileW
LCMapStringW
SetHandleCount
SetThreadPriority
GetVersionExW
GetWindowsDirectoryA
GetThreadLocale
GetWindowsDirectoryW
FormatMessageW
FlushFileBuffers
TerminateProcess
GetModuleFileNameW
VirtualAlloc
InitializeCriticalSectionAndSpinCount
GetCPInfo
GlobalUnlock
GetTickCount
GetSystemInfo
GetCurrentThreadId
GetModuleHandleW
CreateDirectoryA
GetEnvironmentStringsW
lstrcatW
GetFullPathNameW
OutputDebugStringA
GetCommandLineW
GetVersionExA
CreateMutexW
FileTimeToSystemTime
DeleteFileA
ReleaseSemaphore
FindResourceA
GetConsoleMode
GetStartupInfoA
CreateFileMappingA
lstrcmpA
InterlockedCompareExchange
lstrcmpiA
SetFilePointer
GetCurrentProcessId
shell32
SHBrowseForFolderA
DragQueryFileW
CommandLineToArgvW
SHFileOperationW
DragQueryFileA
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetFileInfoW
SHBindToParent
ShellExecuteA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHChangeNotify
SHGetDesktopFolder
SHGetMalloc
ShellExecuteExW
ShellExecuteW
SHBrowseForFolderW
ole32
CoUnmarshalInterface
WriteClassStm
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
CoTaskMemAlloc
CoGetObjectContext
CoCreateFreeThreadedMarshaler
CoRevertToSelf
PropVariantClear
IIDFromString
CoGetClassObject
CoMarshalInterface
CreateDataAdviseHolder
CoCreateGuid
CoRevokeClassObject
CLSIDFromProgID
CreateOleAdviseHolder
GetRunningObjectTable
MkParseDisplayName
OleRun
CoUninitialize
StringFromIID
CoInitializeEx
StringFromCLSID
CoTaskMemRealloc
CoGetMalloc
StgOpenStorage
CreateStreamOnHGlobal
CoCreateInstance
OleUninitialize
OleRegGetUserType
StgCreateDocfile
GetHGlobalFromStream
StringFromGUID2
OleSaveToStream
StgCreateDocfileOnILockBytes
OleInitialize
CoCreateInstanceEx
OleRegEnumVerbs
CoMarshalInterThreadInterfaceInStream
CoDisconnectObject
OleLoadFromStream
StgIsStorageFile
ProgIDFromCLSID
OleRegGetMiscStatus
CreateItemMoniker
CoSetProxyBlanket
CLSIDFromString
CoTaskMemFree
CoImpersonateClient
PropVariantCopy
CoReleaseMarshalData
CoInitialize
CoRegisterClassObject
ReleaseStgMedium
CreateBindCtx
CoGetInterfaceAndReleaseStream
msvcrt
towupper
_acmdln
memmove
__dllonexit
atoi
_cexit
_CIsqrt
_lock
_strdup
_XcptFilter
_wtoi
floor
towlower
??2@YAPAXI@Z
strtok
wcsspn
sprintf
iswspace
qsort
mbstowcs
realloc
time
_wsplitpath
wcsncmp
_beginthreadex
bsearch
_CIacos
fclose
_fileno
__badioinfo
free
isdigit
_purecall
_vsnwprintf
_wcsupr
__pioinfo
__getmainargs
_wtol
fwrite
wcsrchr
strchr
isleadbyte
_itow
strstr
wcstok
rand
__wgetmainargs
fread
_wcsdup
iswalpha
malloc
??1type_info@@UAE@XZ
strrchr
_isatty
_write
_wcsnicmp
_except_handler3
_initterm
wcsstr
wcscat
_wcslwr
_ultoa
ceil
_ftol
swprintf
_wfopen
atol
_controlfp
wcspbrk
strtoul
__p__commode
wcstoul
strncpy
wcslen
isxdigit
_snprintf
__p__fmode
_errno
_local_unwind2
wcscspn
_onexit
tolower
wcsncpy
_c_exit
srand
__setusermatherr
Sections
DATA Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: 512B - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.textbss Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 492B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ