Static task
static1
Behavioral task
behavioral1
Sample
195705af2b199ced5cf82bead760a506_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
195705af2b199ced5cf82bead760a506_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
195705af2b199ced5cf82bead760a506_JaffaCakes118
-
Size
68KB
-
MD5
195705af2b199ced5cf82bead760a506
-
SHA1
012de7cc58b2bc92e5b9b1f7fc6436d29f1920a8
-
SHA256
66cca5939b05abe5461332c26d44cfdc0c9a33647a93fab13ab87ea3418da702
-
SHA512
7aaa30eeb4c3be783771ed9e22d7e786f5d655709655ca187f9717b5e634a39cb15db272f729b7cbad324d3f2b07fed54d07a3056d5d51e55639a0e75ee07a9a
-
SSDEEP
1536:gPWQJNkZJ1WMhZznl77I5v0fNeUYOeNix+r7CRPmFA:OWQJNa1xl/Wv0lBTb+reZEA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 195705af2b199ced5cf82bead760a506_JaffaCakes118
Files
-
195705af2b199ced5cf82bead760a506_JaffaCakes118.exe windows:4 windows x86 arch:x86
8947c8871f21bd2ae6dd69def609275c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
GetVolumeInformationA
GetProcAddress
LoadLibraryA
WriteFile
ExpandEnvironmentStringsA
GetTickCount
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
TerminateThread
GetTempPathA
lstrcmpA
WaitForSingleObject
ResetEvent
CreateEventA
WideCharToMultiByte
lstrlenW
lstrcmpiA
GetFileSize
GetCurrentThreadId
GetVersionExA
SetFileAttributesA
GetModuleFileNameA
CreateProcessA
Sleep
lstrlenA
GetLastError
CreateMutexA
WinExec
GetStartupInfoA
GetModuleHandleA
ReadFile
CloseHandle
FindFirstFileA
FindNextFileA
DeleteFileA
FindClose
user32
GetForegroundWindow
SetForegroundWindow
GetKeyboardLayout
shell32
StrStrA
SHGetSpecialFolderPathA
shlwapi
SHDeleteKeyA
StrPBrkA
PathFileExistsA
ole32
CoInitialize
CoCreateInstance
CLSIDFromProgID
msvcp60
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
oleaut32
SysAllocStringLen
SysStringLen
VariantClear
SysFreeString
SysAllocString
msvcrt
fwrite
_stricmp
_wcsupr
_wcslwr
_strnicmp
_strupr
_strlwr
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_except_handler3
srand
wcslen
wcsstr
wcsncpy
fgetc
fseek
ftell
fread
strtok
rand
time
sprintf
memset
strcat
strcmp
strncat
strncpy
strlen
strcpy
free
strstr
malloc
memcpy
fclose
_strdup
fopen
swprintf
??2@YAPAXI@Z
__CxxFrameHandler
sscanf
atoi
strchr
fgets
fprintf
exit
fputs
Sections
.text Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE