Static task
static1
Behavioral task
behavioral1
Sample
1777a6eee1eaad920850d9338547f5d6_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1777a6eee1eaad920850d9338547f5d6_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1777a6eee1eaad920850d9338547f5d6_JaffaCakes118
-
Size
129KB
-
MD5
1777a6eee1eaad920850d9338547f5d6
-
SHA1
057e90f5216e1927734f762237c23df269eb8208
-
SHA256
163ec0f26d6de2dda97e8afdf56c6fe51b626ddfca9f6e10a28386ede32cbafd
-
SHA512
f388505d8c14c19dabd40c91399c06c421c40f57b8aa1401a0a1e81e739f1a09c0492c4d1b6baed899c2a626ebfe272a29d9c3767d26e1727e8c38ab0e36d34c
-
SSDEEP
3072:qk/VOMX/o1VcrRfBD1VgZ/ls3sdgAXbVH+LPuFHc:L08McrjDgl5dgcbJEPp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1777a6eee1eaad920850d9338547f5d6_JaffaCakes118
Files
-
1777a6eee1eaad920850d9338547f5d6_JaffaCakes118.exe windows:5 windows x86 arch:x86
baf6e723518278078e71e8b48b94b643
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ufat
FormatEx
?Initialize@FILEDIR@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@K@Z
ChkdskEx
?Read@REAL_FAT_SA@@UAEEPAVMESSAGE@@@Z
?IsValidLastAccessTime@FAT_DIRENT@@QBEEXZ
??0REAL_FAT_SA@@QAE@XZ
?QueryName@FAT_DIRENT@@QBEEPAVWSTRING@@@Z
Chkdsk
??1FAT_SA@@UAE@XZ
?QueryAllocatedClusters@FAT@@QBEKXZ
?QueryFreeSectors@REAL_FAT_SA@@QBEKXZ
?InitFATChkDirty@REAL_FAT_SA@@QAEEPAVLOG_IO_DP_DRIVE@@PAVMESSAGE@@@Z
?IsValidLastWriteTime@FAT_DIRENT@@QBEEXZ
?Index12@FAT@@ABEKK@Z
??0EA_HEADER@@QAE@XZ
??1FAT_DIRENT@@UAE@XZ
?Initialize@EA_SET@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?Read@EA_SET@@UAEEXZ
??1EA_HEADER@@UAE@XZ
??1FILEDIR@@UAE@XZ
??1ROOTDIR@@UAE@XZ
Format
?QueryLastAccessTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
?Initialize@FAT_DIRENT@@QAEEPAX@Z
?IsValidCreationTime@FAT_DIRENT@@QBEEXZ
?QueryFileStartingCluster@FAT_SA@@QAEKPBVWSTRING@@PAVHMEM@@PAPAVFATDIR@@PAEPAVFAT_DIRENT@@@Z
?FreeChain@FAT@@QAEXK@Z
?AllocChain@FAT@@QAEKKPAK@Z
??0FAT_SA@@QAE@XZ
Recover
?QueryLongName@FATDIR@@QAEEJPAVWSTRING@@@Z
?QueryLengthOfChain@FAT@@QBEKKPAK@Z
?Initialize@FAT_DIRENT@@QAEEPAXE@Z
??1CLUSTER_CHAIN@@UAE@XZ
?QueryEaSetClusterNumber@EA_HEADER@@QBEGG@Z
?QueryCreationTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
??0CLUSTER_CHAIN@@QAE@XZ
?GetEa@EA_SET@@QAEPAU_EA@@KPAJPAE@Z
?Initialize@ROOTDIR@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@KJ@Z
?Write@CLUSTER_CHAIN@@UAEEXZ
??0FAT_DIRENT@@QAE@XZ
??1REAL_FAT_SA@@UAE@XZ
??1EA_SET@@UAE@XZ
expsrv
_adj_fdiv_m32i
rtcWeekdayName
__vbaCyVar
__vbaPutFxStr4
EbSetContextWorkerThread
PutMem4
__vbaVarLateMemCallLdRf
__vbaWriteFile
_adj_fprem
__vbaCyErrVar
__vbaVarForNext
__vbaCopyBytes
__vbaObjVar
__vbaAryVar
EbCreateContext
rtcRound
IID_IVbaHost
__vbaFpCDblR4
rtcRandomize
__vbaPrintObj
rtcGetDateVar
__vbaStrAryToUnicode
__vbaError
__vbaCyUI1
__vbaStrVarCopy
__vbaVarLateMemCallSt
__vbaVargVarCopy
msvcp60
?cos@?$_Ctr@O@std@@SAOO@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z
?_Fabs@std@@YANABV?$complex@N@1@PAH@Z
?stossc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
??_7?$moneypunct@G$00@std@@6B@
??Zstd@@YAAAV?$complex@O@0@AAV10@ABV10@@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
??0?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?min@?$numeric_limits@G@std@@SAGXZ
??1?$codecvt@GDH@std@@UAE@XZ
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$complex@N@0@@Z
_Wcrtomb
?_Init@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
??0_Lockit@std@@QAE@XZ
_Strcoll
?_Init@?$numpunct@D@std@@IAEXABV_Locinfo@2@@Z
?close@?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDF@Z
??0?$collate@D@std@@QAE@I@Z
_LDtest
??4?$basic_iostream@GU?$char_traits@G@std@@@std@@QAEAAV01@ABV01@@Z
??0runtime_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?log@?$_Ctr@O@std@@SAOO@Z
?copyfmt@ios_base@std@@QAEAAV12@ABV12@@Z
?negative_sign@?$_Mpunct@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?at@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
?sputbackc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBGI@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0PBD@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IID@Z
kernel32
EnumerateLocalComputerNamesA
GetTimeFormatW
VirtualAllocEx
VirtualAlloc
InterlockedIncrement
ReadConsoleOutputA
GetQueuedCompletionStatus
GetConsoleOutputCP
AddConsoleAliasA
GetSystemTimeAsFileTime
CreateFileMappingA
EnumTimeFormatsA
GetHandleInformation
Process32FirstW
LoadLibraryA
TlsSetValue
SetThreadExecutionState
RtlFillMemory
FindClose
lstrlenW
GetCurrentProcessId
GetNamedPipeHandleStateA
GetDefaultCommConfigW
SetComputerNameA
FormatMessageW
DisableThreadLibraryCalls
SetCommBreak
CancelDeviceWakeupRequest
GetFileSize
UnlockFileEx
glmf32
glsUTF8toUCSz
glsEndObj
glsCallStream
glsNumfv
glsGetStreamCRC32
glsNumd
glsAppRef
glsGetAllContexts
glsLong
glsBinary
glsEnumString
glsGenContext
glsULong
glsGetCaptureDispatchTable
glsGetCurrentTime
__glsParser_print
glsDisplayMapfv
glsUCS4toUTF8z
glsEndGLS
glsHeaderLayeri
glsBeginCapture
glsEndCapture
glsPad
glsCallArrayInContext
glsBeginGLS
glsNuml
glsUCS4toUTF8
__glsString_init
glsCallArray
glsBeginObj
glsDeleteStream
glsNumuiv
unimdmat
UmLogStringA
UmGenerateDigit
UmInitializeModemDriver
UmGetDiagnostics
UmLogDiagnostics
UmSetPassthroughMode
UmAnswerModem
UmWaveAction
UmIssueCommand
UmAbortCurrentModemCommand
UmDialModem
UmDuplicateDeviceHandle
UmMonitorModem
UmSetSpeakerPhoneState
UmDeinitializeModemDriver
UmCloseModem
UmOpenModem
UmHangupModem
UmInitModem
query
?Release@CQueryUnknown@@UAGKXZ
?AcqLine@CQueryScanner@@QAEPAGH@Z
?_FindOrAddAnchor@CDbProjectNode@@AAEPAVCDbProjectListAnchor@@XZ
??0CFwEventItem@@QAE@GKGKPAX@Z
??0CLocalGlobalPropertyList@@QAE@PAVCEmptyPropertyList@@HPBGK@Z
?SetUI1@CStorageVariant@@QAEXEI@Z
??0CPathParser@@QAE@PBGK@Z
?StrLen@CKeyBuf@@QBEIXZ
??0CColumnSet@@QAE@I@Z
?Close@CPhysStorage@@QAEXXZ
?SetRestriction@CDbSelectNode@@QAEHPAVCDbCmdTreeNode@@@Z
?AcqRst@CRangeKeyRepository@@QAEPAVCRangeRestriction@@XZ
?IsPaused@CCatalogAdmin@@QAEHXZ
??0CDbNatLangRestriction@@QAE@PBGABVCDbColumnNode@@K@Z
??0CAllocStorageVariant@@QAE@PBU_GUID@@AAVPMemoryAllocator@@@Z
??1CCatState@@QAE@XZ
?GetCD@CCatState@@QAEPBGXZ
?BuildRegistryPropertiesKey@@YGXAAV?$XArray@G@@PBG@Z
??0CLangList@@QAE@PAUICiCLangRes@@K@Z
?GetAllEntries@CPropertyList@@UAEJPAPAVCPropEntry@@K@Z
?NameToReal@CPidRemapper@@QAEKPBVCFullPropSpec@@@Z
?Next@CPropertyList@@UAEPBVCPropEntry@@XZ
?ReleaseRead@CPropertyStore@@AAEXAAVCReadWriteLockRecord@@@Z
?SetPath@CScopeAdmin@@QAEXPBG@Z
?Impersonate@CImpersonateClient@@AAEXXZ
?RemoveFirstChild@CDbCmdTreeNode@@IAEPAV1@XZ
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 70KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ