GPackage
Static task
static1
Behavioral task
behavioral1
Sample
9f126f279924399c66ad335762f5166d_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9f126f279924399c66ad335762f5166d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9f126f279924399c66ad335762f5166d_JaffaCakes118
-
Size
148KB
-
MD5
9f126f279924399c66ad335762f5166d
-
SHA1
a872d19b44aca9e116b4ae8c8af9fbc6b4b123c7
-
SHA256
374380da46dd707425fcc340096748c67b0059684e4521bba8fb64ed086ad235
-
SHA512
2e7fd7cfc87891e13bc31f1a568c6d7083eaaceacc183d657a74272812b6cd50f33ff4896b71e106058068885088937ca87a30cb39fce9baa746b77dd476c203
-
SSDEEP
1536:9PjmXAE9U/pd0xvZ4y76Nn3k2mZ8Sta81fd9fFE5p:tjmQdcqy76N3k2mZ8Sta81fdxFE5p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9f126f279924399c66ad335762f5166d_JaffaCakes118
Files
-
9f126f279924399c66ad335762f5166d_JaffaCakes118.exe windows:4 windows x86 arch:x86
a00452665447483d94e00f3231af82bf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
core
?GCRCTable@@3PAKA
?GMalloc@@3PAVFMalloc@@A
??DFString@@QBEPBGXZ
?GLogHook@@3PAVFOutputDevice@@A
?appSprintf@@YAHPAGPBGZZ
?SafeString@FName@@SAPBGW4EName@@@Z
?Logf@FOutputDevice@@QAAXW4EName@@PBGZZ
?appTimestamp@@YAPBGXZ
?GFileManager@@3PAVFFileManager@@A
?GNull@@3PAVFOutputDevice@@A
?appStrcat@@YAPAGPAGPBG@Z
?appPackage@@YAPBGXZ
?Parse@@YAHPBG0PAGH@Z
?appCmdLine@@YAPBGXZ
?appStrlen@@YAHPBG@Z
?appStrcpy@@YAPAGPAGPBG@Z
?appBaseDir@@YAPBGXZ
?SafeSuppressed@FName@@SAHW4EName@@@Z
?GIsCriticalError@@3HA
?Flush@FOutputDevice@@UAEXXZ
?appRequestExit@@YAXH@Z
?LocalizeError@@YAPBGPBDPBG1@Z
?GIsGuarded@@3HA
?appStrncat@@YAPAGPAGPBGH@Z
?appStrncpy@@YAPAGPAGPBGH@Z
?GErrorHist@@3PAGA
?StaticShutdownAfterError@UObject@@SAXXZ
?GLog@@3PAVFOutputDevice@@A
?GIsRunning@@3HA
?MapCheck_Add@FFeedbackContext@@UAEXHPAXPBG@Z
?MapCheck_Clear@FFeedbackContext@@UAEXXZ
?MapCheck_Hide@FFeedbackContext@@UAEXXZ
?MapCheck_ShowConditionally@FFeedbackContext@@UAEXXZ
?MapCheck_Show@FFeedbackContext@@UAEXXZ
?appUnwindf@@YAXPBGZZ
??1FString@@QAE@XZ
??DFName@@QBEPBGXZ
?ParseParam@@YAHPBG0@Z
?GIsEditor@@3HA
?GIsClient@@3HA
?appGetVarArgs@@YAHPAGHAAPBG@Z
?GIsSlowTask@@3HA
?appFailAssert@@YAXPBD0H@Z
?CalcHomeDir@FFileManager@@UAEPBGXZ
?Init@FFileManager@@UAEXH@Z
?ReallocContiguous@FMalloc@@UAEPAXPAXKKPBG@Z
??0FString@@QAE@ABV0@@Z
??YFString@@QAEAAV0@PBG@Z
?appStricmp@@YAHPBG0@Z
?Logf@FOutputDevice@@QAAXPBGZZ
??1FRegistryObjectInfo@@QAE@XZ
?Add@FArray@@QAEHHH@Z
?StaticConstructObject@UObject@@SAPAV1@PAVUClass@@PAV1@VFName@@K1PAVFOutputDevice@@1@Z
?GError@@3PAVFOutputDeviceError@@A
?GetTransientPackage@UObject@@SAPAVUPackage@@XZ
?PrivateStaticClass@UCommandlet@@0VUClass@@A
??4FString@@QAEAAV0@ABV0@@Z
??HFString@@QAE?AV0@PBG@Z
??0FString@@QAE@PBG@Z
?appStrchr@@YAPAGPBGH@Z
?winToANSI@@YAPADPADPBGH@Z
?winGetSizeANSI@@YAHPBG@Z
?GUnicodeOS@@3HA
?GetError@FArchive@@UAEHXZ
?Flush@FArchive@@UAEXXZ
?DetachLazyLoader@FArchive@@UAEXPAVFLazyLoader@@@Z
?AttachLazyLoader@FArchive@@UAEXPAVFLazyLoader@@@Z
?SetStopper@FArchive@@UAEXH@Z
?AtStopper@FArchive@@UAEHXZ
?AtEnd@FArchive@@UAEHXZ
?MapObject@FArchive@@UAEHPAVUObject@@@Z
?MapName@FArchive@@UAEHPAVFName@@@Z
??6FArchive@@UAEAAV0@AAVFName@@@Z
??6FArchive@@UAEAAV0@AAPAVUObject@@@Z
?CountBytes@FArchive@@UAEXKK@Z
?Preload@FArchive@@UAEXPAVUObject@@@Z
?SerializeInt@FArchive@@UAEXAAKK@Z
?SerializeBits@FArchive@@UAEXPAXH@Z
??1FArchive@@UAE@XZ
??0FArchive@@QAE@XZ
?appGetSystemErrorMessage@@YAPBGH@Z
?Precache@FArchive@@UAEXH@Z
?TotalSize@FArchive@@UAEHXZ
GIsSSE
?appFromAnsi@@YAPBGPBDPAG@Z
??_7FArchive@@6B@
?Remove@FArray@@QAEXHHH@Z
??1FArray@@QAE@XZ
??DFString@@QBE?AV0@ABV0@@Z
??DFString@@QBE?AV0@PBG@Z
?Realloc@FArray@@IAEXH@Z
?winToUNICODE@@YAPAGPAGPBDH@Z
?winGetSizeUNICODE@@YAHPBD@Z
??0FString@@QAE@XZ
??4FString@@QAEAAV0@PBG@Z
?appStaticString1024@@YAPAGXZ
?appAtoi@@YAHPBG@Z
?appAtof@@YAMPBG@Z
?Log@FOutputDevice@@QAEXPBG@Z
??8FString@@QBEHPBG@Z
?appSaveStringToFile@@YAHABVFString@@PBGPAVFFileManager@@@Z
??YFString@@QAEAAV0@ABV0@@Z
?Printf@FString@@SA?AV1@PBGZZ
??8FString@@QBEHABV0@@Z
?appStrstr@@YAPAGPBG0@Z
?appLoadFileToString@@YAHAAVFString@@PBGPAVFFileManager@@@Z
?appStrcmp@@YAHPBG0@Z
?appExit@@YAXXZ
?appPreExit@@YAXXZ
?GWarn@@3PAVFFeedbackContext@@A
?ParseParms@UObject@@QAEXPBG@Z
?GetFullName@UObject@@QBEPBGPAG@Z
??9FString@@QBEHPBG@Z
?Mid@FString@@QBE?AV1@HH@Z
?InStr@FString@@QBEHPBGH@Z
?Log@FOutputDevice@@QAEXABVFString@@@Z
??HFString@@QAE?AV0@ABV0@@Z
?GetDefaultObject@UClass@@QAEPAVUObject@@XZ
?ParseToken@@YAHAAPBGAAVFString@@H@Z
?StaticLoadClass@UObject@@SAPAVUClass@@PAV2@PAV1@PBG2KPAVUPackageMap@@@Z
?GLazyLoad@@3HA
?GIsServer@@3HA
?GIsScriptable@@3HA
?GIsUCC@@3HA
?GetRegistryObjects@UObject@@SAXAAV?$TArray@VFRegistryObjectInfo@@@@PAVUClass@@1H@Z
?PrivateStaticClass@UClass@@0V1@A
?SetLanguage@UObject@@SAXPBG@Z
?appInit@@YAXPBG0PAVFMalloc@@PAVFOutputDevice@@PAVFOutputDeviceError@@PAVFFeedbackContext@@PAVFFileManager@@P6APAVFConfigCache@@XZH@Z
?GIsStarted@@3HA
kernel32
GetFileSize
CreateFileA
CreateFileW
SetFilePointer
CloseHandle
SetFileAttributesA
SetFileAttributesW
WriteFile
GetLastError
DeleteFileA
DeleteFileW
MoveFileA
MoveFileW
GetFileAttributesExW
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
ReadFile
CopyFileA
CopyFileW
CreateDirectoryA
CreateDirectoryW
RemoveDirectoryA
RemoveDirectoryW
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetCommandLineA
GetModuleHandleA
msvcr70
_purecall
wprintf
_CxxThrowException
fflush
_iob
fgets
malloc
free
realloc
_heapchk
calloc
??1type_info@@UAE@XZ
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_cexit
exit
__p___initenv
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
_except_handler3
__CxxFrameHandler
Exports
Exports
Sections
.text Size: 92KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ