Static task
static1
Behavioral task
behavioral1
Sample
266d7a1f98ef61c4d41be7794468e168_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
266d7a1f98ef61c4d41be7794468e168_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
266d7a1f98ef61c4d41be7794468e168_JaffaCakes118
-
Size
864KB
-
MD5
266d7a1f98ef61c4d41be7794468e168
-
SHA1
b49652d166641de125b34d7d3ca5dcc392b9472e
-
SHA256
44c5bc6668b5c206ba68756791f96432cfd39fbda446cebaf7934f544cebe387
-
SHA512
3751b0e262f61ae1a683c4e771d72111e8e0f60dc04363188a6244611607eda01920c23150dc302a00e9360cee84ba94e4948169f20441636c9d97d3ba7c62aa
-
SSDEEP
24576:k8OE/D/GIMDigU9gEYMEjc6P4koD+8WksjcseJVnsGm5B3y1:k8OerezFEjIPho3Wr2/N1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 266d7a1f98ef61c4d41be7794468e168_JaffaCakes118
Files
-
266d7a1f98ef61c4d41be7794468e168_JaffaCakes118.exe windows:5 windows x86 arch:x86
608e7841b85f270c49b7963629465ec0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetUserDefaultLCID
GetVolumeInformationA
VerLanguageNameW
EnterCriticalSection
WriteConsoleOutputA
SetVolumeLabelA
SetMessageWaitingIndicator
GetConsoleCharType
EnumDateFormatsExW
LCMapStringA
TzSpecificLocalTimeToSystemTime
GetStringTypeExA
FindActCtxSectionGuid
GlobalUnWire
RtlCaptureContext
GetWindowsDirectoryW
GetACP
VirtualAlloc
CopyFileExW
WTSGetActiveConsoleSessionId
IsValidLocale
ReadConsoleW
IsDebuggerPresent
OpenFileMappingA
LocalFlags
SetVolumeLabelW
NlsGetCacheUpdateCount
SetConsoleHardwareState
OpenProcess
GetWindowsDirectoryA
EndUpdateResourceW
SetCommBreak
GetPrivateProfileSectionW
GetConsoleKeyboardLayoutNameA
GetVersionExW
BaseInitAppcompatCacheSupport
GetDevicePowerState
WaitForSingleObjectEx
BaseCheckAppcompatCache
lstrcpyA
LoadLibraryA
SetCalendarInfoA
FoldStringA
EnumTimeFormatsW
GetSystemDefaultLCID
FatalAppExitA
IsValidCodePage
SetFileTime
SizeofResource
UTRegister
LeaveCriticalSection
adsldpc
AdsTypeToLdapTypeCopyDNWithString
LdapSearchS
ADSIGetNextColumnName
LdapCountEntries
ADSICreateDSObject
SchemaOpen
LdapIsClassNameValidOnServer
LdapDeleteExtS
LdapResult
LdapModifyExtS
FindEntryInSearchTable
LdapGetNextPageS
ReallocADsStr
LdapNextAttribute
LdapMakeSchemaCacheObsolete
SchemaGetPropertyInfo
LdapNextEntry
ADsGetLastError
SchemaIsClassAContainer
ADsGetObjectAttributes
LdapSearchST
Component
AdsTypeToLdapTypeCopyGeneralizedTime
LdapDeleteS
ADsFreeColumn
ADsDeleteAttributeDefinition
LdapGetDn
FreeADsMem
SchemaGetStringsFromStringTable
BerBvFree
ReallocADsMem
ADsWriteAttributeDefinition
ADSIOpenDSObject
LdapCacheAddRef
LdapOpenObject2
LdapMsgFree
SortAndRemoveDuplicateOIDs
SchemaGetClassInfo
LdapGetSyntaxOfAttributeOnServer
LdapReadAttribute2
ADSISetObjectAttributes
LdapParsePageControl
dciman32
DCIDraw
DCIDestroy
DCICreatePrimary
DCIEnum
GetDCRegionData
DCICreateOffscreen
WinWatchDidStatusChange
DCIOpenProvider
DCISetClipList
DCISetSrcDestClip
WinWatchGetClipList
DCISetDestination
GetWindowRegionData
WinWatchNotify
WinWatchOpen
WinWatchClose
DCICloseProvider
DCIEndAccess
DCICreateOverlay
DCIBeginAccess
msvcp60
??7ios_base@std@@QBE_NXZ
?find_last_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??_F?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?_Psum@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPAGPAGI@Z
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@
??4?$numeric_limits@_N@std@@QAEAAV01@ABV01@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAPAX@Z
??0?$complex@O@std@@QAE@ABO0@Z
?_Getcat@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIXZ
??0?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBG@Z
??0?$complex@N@std@@QAE@ABN0@Z
wctype
wcrtomb
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?polar@std@@YA?AV?$complex@N@1@ABN0@Z
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
??4_Winit@std@@QAEAAV01@ABV01@@Z
?pubimbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?grouping@?$_Mpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?decimal_point@?$_Mpunct@D@std@@QBEDXZ
??1?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
btowc
??_7ios_base@std@@6B@
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?narrow@?$ctype@G@std@@QBEDGD@Z
?cosh@std@@YA?AV?$complex@M@1@ABV21@@Z
?id@?$messages@D@std@@2V0locale@2@A
?_Cltab@?$ctype@D@std@@0PBFB
??0overflow_error@std@@QAE@ABV01@@Z
lz32
LZOpenFileA
LZSeek
LZRead
GetExpandedNameA
LZCreateFileW
LZCloseFile
LZDone
LZInit
LZClose
LZCopy
LZStart
LZOpenFileW
CopyLZFile
Sections
.text Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 214KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 469KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ