Static task
static1
Behavioral task
behavioral1
Sample
e2eef3154ac480626174c41dc166a2db_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e2eef3154ac480626174c41dc166a2db_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
e2eef3154ac480626174c41dc166a2db_JaffaCakes118
-
Size
1.5MB
-
MD5
e2eef3154ac480626174c41dc166a2db
-
SHA1
bed638a383758fb823c8b8942e7b4b16969fc2d5
-
SHA256
aa6703271ba6164a0b1924968b3a09015165e1dad5c44980ad9fd65b507e8d8c
-
SHA512
977c742809d5a5515307f76b3963d6a0db0a8adc8544ac449dd1027100ba1a233dabd8e8884d86dc515843f511bb712074d517c86497f227d13ff234e2075bf2
-
SSDEEP
12288:TYujabNuQcJFAs72RV8P2GR5fjfT5yZ6xpT6pfTcV39FFFfW:TY283kxR5DT586xF6fTcV39FFFfW
Malware Config
Signatures
Files
-
e2eef3154ac480626174c41dc166a2db_JaffaCakes118.exe windows:4 windows x86 arch:x86
3ef6ada08788c2b66af8f0141cd7c51b
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01-08-1996 00:00Not After31-12-2020 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06-08-2003 00:00Not After05-08-2013 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
61:3b:f8:85:49:64:12:20:7e:cb:70:ac:fa:c6:75:5bCertificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before24-11-2006 00:00Not After23-11-2008 23:59SubjectCN=Qizhi Software (beijing) Co. Ltd,OU=Secure Application Development,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
mpr
WNetGetUserA
gdi32
UnrealizeObject
comctl32
ImageList_SetIconSize
shell32
ShellExecuteA
wininet
InternetReadFile
ws2_32
gethostname
winmm
waveInUnprepareHeader
netapi32
Netbios
wsock32
WSACleanup
avicap32
capCreateCaptureWindowA
msvfw32
DrawDibDraw
urlmon
URLDownloadToFileA
Exports
Exports
�մ�\��d*i�h]uz�)*�&¯�j���ֲi墳�D,��?�`@,�����L�C�*NX��A�m�O�#�鉄Ԝ*n���kۂ� ɔ)֧�x-��c�GڪF̑Qp�f/P��W��Yjd�e��E���w(�$.��m�j�(9ݟ8�<���ȧs)��7�P���ٹT#4c���� ���cVFd*�#7}D]���?=�}���e[{g&|��0Ċ|����i�PbI��1 �0m� �D��+�1l�6�� �u�F� ��J�6�Ѱ�Gކ��0sW);�[U��w26)c�˕P��W<*���i(���G�Y<�`E��J��z`���`�/xZm��j���1U<�գ5�����V ����oMT��̝��q{)�����$9�90M�L��X���F�G���q�K��쎳D�c0][�H+E�w��`O��2_wɾ�!ڧH�*m�շ����gv&���������p9��P���� JLl[���҇�p�Y!����,$;������ ��L.>��䓴��R���8x�k�d�)x�Q����5�5r.���Y b +ņ��n��%�;�!.~����c�8H�8�I�ƴw��=�l�"� U�✙�Q\__����d ��%_'�hj�g�)�ޕ-ח-Qµ�u��vR?��9S���Oq)�I�%����� L7�@*�O��Z��3��(�X��r��?\�� _�ETc�Q5+�BO`���ǻT����FR���9o�L�:Z�7���Ǩ����}s[}~���V�1,{�0\�}�"�%�a3-c{�F��S������L���r��){j�A����C����4��*��l!��Ί�����.�zO�*�����HK�rOR���vR�y�X����� ����t��SR��<����F���X�G$��ϣ/Vₔ7m,����~��<�S��w���?���5��~UF���5��aa�.��s �1 ��D�2�;�j����%��S�� �<|H>��� ���(�c5<���/_���頔�Q��.� �Up�~�n;��X(�;5>]�(=rtގѝ�P��xV�����\3��/���Ua�����}\���&��s=����L흕 f�UՄC���4�h���#��d˗��:���{`�Me�M93�%�E��Y����"CtE)�C�U�?q��mt���{���T�?��G�@�h�ĘR�R[�B�/���Z\�/{c�N��m�%yR�,|��}���)t��cG���H�hD��?vL]?T�pe�����(����2�|�~Z��H��ׅ2�.�r��d�� 2��������Row瞤cNci#���o����u?,������D�i �Kǰ��aX�һ��g˦RV�h�n�"6�K�,��jϮm`����Ǣ���OQ&�͘��%�}�UU\��FK�G�_ ]���=��{|��ӰS}-��~�o�� Xy�7!�#��,f5ax�!���'"�Ɠ��4L�䈢1Ӆ1ڭn�h7> -b�ň�����ڿ�Ҩ� A ���7��֩"�i�"!}g���.��n��s���w���f�K���n��pI>����.����{0���M�*YT���w%��uκ����T���,Lei� �Ew�WB0$߮G���|O�H4��Y]sC�x|q����+�Ѩ������iĈ�*��@��꼔2���%d�f�>1i�*���(ĸf��ʣ]�H2F(�����Dad9v&��A x�:��KZ .ߧ?[a��{L�&�� �� ���hҷl������8\�����I�w��D������>�x^K|0���̯>Դ����(Hol����;nT{4�& ��O�K��� $#z�ot�Q� ��<fu���<$\��n������L̛uZ�(!�.h:ڗ(���>: Mv3YR����>B>�����!k�0�$f<d\�t��u fg:�7�����c���:��lf���\۬8�ė)X�}�i��/ج�y�"rV7r����ok �L4_��Ȯ���U1����q���|(<2aT��4�b0�.]LEW4�%��O���V!�pʂ撾����T��K&�!4� �i4�8k��������[u/���u�d��;��a�^�l���\�]���:nC a_�d��B�O��Ղ�?�, �y�Mw03yʧ�A �x����UKn�/r� ʡe��ѐd:�ݓa��Q�;���m]]��A-S7?�3������m=����V�nR���R^�5�S���������s�jI ��x���P�n�(T��τ{������\&�(E\y� v���I������5ˡA�!��t�'o�m������{$M.UO��+�ieW��u�U���2n�ܼ�zB���h��4o�7��W�X�����19�r���c�/mp�M���kF�)�1�l\}~���vx^�<&��I0.5�a�� E�m��b�� k�m�����r���}�k������K'F��E��Ma֕ a8J4_5�/^É��X�-|�zЊK<�O�$*�o��W+ZE�6��/��dS7��,[�ǣ��n��/Dftq���PHGѫ����Кi/{7�9I���PGF��μ�Z�F>c�R�u���m����X,������GZ��k��CZ�Ԕ|���J~}��urr��إ��TB��� ��X�!�9JIpf�(i��vM{��I'����������ewP��Kl;����`1Qۺ��ضd}�+��c2\r�I��xنN���eU�����_٥� �g���+d��K�3��� g���W�D;�$�0��̘��\�� �jv)}�{.b �e��+�I5�H@��0\�J?���/ ��-2��泝Z���;p�_�*��>�w[v�!y����t��B��/~!�ݳTaۿ������IZH#>q��?y�^��xFJ�v5A��'�K�vzMhY�pT���Q�~�`��ƀ�ӻh� %{�=#">\��[���(Y��xWy��?4`(�[�� �F&�)�8��H�x��f"{X����;����fh����<@ �w
Sections
CODE Size: - Virtual size: 607KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.test Size: - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 282KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 703KB - Virtual size: 702KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ