Static task
static1
Behavioral task
behavioral1
Sample
b347fcebd6cebd76f4a8d2b9c8c6c05d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b347fcebd6cebd76f4a8d2b9c8c6c05d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
b347fcebd6cebd76f4a8d2b9c8c6c05d_JaffaCakes118
-
Size
578KB
-
MD5
b347fcebd6cebd76f4a8d2b9c8c6c05d
-
SHA1
c9f6ce16914f60febd88aa31659c8ad87ee8c783
-
SHA256
bb5b4172380e4cbacab6f0db6027300b08612014c030710b6dafbfc3f45c9f82
-
SHA512
d6917023c0da3a923005bc94d216e641f14911b60393701ea38863f8f8cdc120cb2bdfad95604cd0a89bb8da348225f3880e8a4bcb612651fbf7c5b82b5c7602
-
SSDEEP
6144:zcJtfwTcb9RtxNJPL41Q686cDxldTf8u6NpvBxukwjJKdTb8XqPm/V1p2fMa2fMg:Ynw+3BYQjtjTUXaIVbFOEa
Malware Config
Signatures
Files
-
b347fcebd6cebd76f4a8d2b9c8c6c05d_JaffaCakes118.exe windows:4 windows x86 arch:x86
d6416e3b84da0e076767a0e0700d5be1
Code Sign
01Certificate
IssuerCN=https://www.samsung.com/us/,O=Samsung Electronics Corporation\, Ltd.,C=USNot Before12/10/2018, 07:25Not After11/10/2021, 07:25SubjectCN=https://www.samsung.com/us/,O=Samsung Electronics Corporation\, Ltd.,C=US7b:8a:b3:e1:91:bd:a5:61:4f:87:c0:b6:62:32:97:73:d5:dd:36:6c:cf:21:46:b8:1b:19:69:6b:e0:3c:3a:2fSigner
Actual PE Digest7b:8a:b3:e1:91:bd:a5:61:4f:87:c0:b6:62:32:97:73:d5:dd:36:6c:cf:21:46:b8:1b:19:69:6b:e0:3c:3a:2fDigest Algorithmsha256PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
ord589
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord517
_adj_fprem1
ord660
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord521
ord522
_CIsin
ord525
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
__vbaVarTstEq
DllFunctionCall
__vbaLbound
_adj_fpatan
__vbaUI1ErrVar
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaStrVarVal
__vbaVarCat
ord645
_CIlog
ord646
__vbaErrorOverflow
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
ord610
__vbaVarDup
__vbaStrToAnsi
_CIatan
__vbaStrMove
ord540
ord618
_allmul
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj
Sections
.text Size: 548KB - Virtual size: 544KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ