Static task
static1
Behavioral task
behavioral1
Sample
2b945d98436ee53f6eb5bec4d220a230_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2b945d98436ee53f6eb5bec4d220a230_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2b945d98436ee53f6eb5bec4d220a230_JaffaCakes118
-
Size
867KB
-
MD5
2b945d98436ee53f6eb5bec4d220a230
-
SHA1
6ee02ed2e3ab0888f71185c88ea18a5d510fb44a
-
SHA256
f03f93e08af30f4ef0973d13830530721eb56eb0f92099421a03beaf0857648e
-
SHA512
ca58783579aee3c63aa7d7415792230541e1622dfab76d64c38e013517de30e83391488efb56fc64e7b785050e3b612232faa21e9e12020209a47cad6aa0afbf
-
SSDEEP
24576:3dmYnXmV3I1p2klVsZOmVl0DNiMHlJk85wNR:tmYXmBe0iAVl0BFM1b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b945d98436ee53f6eb5bec4d220a230_JaffaCakes118
Files
-
2b945d98436ee53f6eb5bec4d220a230_JaffaCakes118.exe windows:5 windows x86 arch:x86
1d3bb48db0e36182c14c8694d1380121
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp60
?_Init@?$codecvt@DDH@std@@IAEXABV_Locinfo@2@@Z
?min@?$numeric_limits@M@std@@SAMXZ
??1?$ctype@D@std@@UAE@XZ
?_Cosh@?$_Ctr@N@std@@SANNN@Z
??X?$_Complex_base@O@std@@QAEAAV01@ABO@Z
?quiet_NaN@?$numeric_limits@O@std@@SAOXZ
??1?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?reserve@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
?setstate@ios_base@std@@QAEXF@Z
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??_7range_error@std@@6B@
??0money_base@std@@QAE@I@Z
?assign@?$char_traits@G@std@@SAPAGPAGIABG@Z
?do_toupper@?$ctype@G@std@@MBEGG@Z
??_F?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??4?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?lt@?$char_traits@D@std@@SA_NABD0@Z
??_7overflow_error@std@@6B@
?real@std@@YAOABV?$complex@O@1@@Z
?_Getcat@?$messages@G@std@@SAIXZ
??Hstd@@YA?AV?$complex@N@0@ABNABV10@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
?do_narrow@?$ctype@G@std@@MBEDGD@Z
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@PBDH@Z
??_7?$moneypunct@G$00@std@@6B@
??1?$basic_fstream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGHG@Z
??Z?$_Complex_base@O@std@@QAEAAV01@ABO@Z
??_8?$basic_ofstream@DU?$char_traits@D@std@@@std@@7B@
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??_7__non_rtti_object@std@@6B@
_Getcvt
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPADH@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$collate@D@std@@QAE@ABV_Locinfo@1@I@Z
?_Init@?$codecvt@GDH@std@@IAEXABV_Locinfo@2@@Z
_Sinh
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$complex@M@0@@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAE@Z
_Wcrtomb
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?do_compare@?$collate@G@std@@MBEHPBG000@Z
??0?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??4_Winit@std@@QAEAAV01@ABV01@@Z
?do_close@?$messages@D@std@@MBEXH@Z
?_Exp@?$_Ctr@O@std@@SAFPAOOF@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?min@?$numeric_limits@H@std@@SAHXZ
??8std@@YA_NABV?$complex@O@0@ABO@Z
?real@?$_Complex_base@N@std@@QAENABN@Z
??_F?$ctype@D@std@@QAEXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@W4_Uninitialized@1@@Z
??_8?$basic_ifstream@GU?$char_traits@G@std@@@std@@7B@
??1ostrstream@std@@UAE@XZ
??Hstd@@YA?AV?$complex@M@0@ABV10@ABM@Z
?pos_format@?$_Mpunct@D@std@@QBE?AUpattern@money_base@2@XZ
?_Getcat@?$collate@G@std@@SAIXZ
?_Xran@std@@YAXXZ
?_Pdif@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAIPBG0@Z
?_Tidy@strstreambuf@std@@IAEXXZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
esent
JetSetLS
JetGetRecordPosition
JetBeginTransaction2
JetSeek
JetComputeStats
JetGetLogInfoInstance
JetUpgradeDatabase
JetMove
JetRenameTable
JetCreateIndex2
JetGetTableInfo
JetRetrieveKey
JetEndExternalBackupInstance2
JetSetDatabaseSize
JetIntersectIndexes
JetGetAttachInfoInstance
JetGetVersion
JetSetIndexRange
JetCommitTransaction@8
JetSeek@12
JetTerm
JetOSSnapshotFreeze
JetRetrieveColumns
JetGetTableIndexInfo
JetExternalRestore
JetCloseFileInstance
JetBeginTransaction
JetGetLogInfoInstance2
JetInit3
JetInit2
JetCloseTable
JetMakeKey
JetBeginSession
JetSnapshotStart
JetGrowDatabase
JetDBUtilities
JetCompact
JetTerm@4
JetCloseDatabase@12
JetGetInstanceInfo
kernel32
DeleteAtom
GetTempPathW
IsValidCodePage
VirtualFree
GetUserDefaultLCID
CommConfigDialogW
GetVersion
GetSystemDefaultLCID
IsDebuggerPresent
GetSystemWow64DirectoryW
ExpandEnvironmentStringsW
EnterCriticalSection
TlsAlloc
GetConsoleCommandHistoryA
EnumSystemGeoID
GetComputerNameW
ExpandEnvironmentStringsA
SetConsoleIcon
Heap32ListFirst
CloseProfileUserMapping
VirtualAlloc
SetLastConsoleEventActive
VirtualFreeEx
DefineDosDeviceA
GetProcessVersion
RtlMoveMemory
lstrcpynW
VDMOperationStarted
LoadLibraryA
LeaveCriticalSection
IsValidLocale
GetFileSizeEx
lz32
LZClose
LZCreateFileW
GetExpandedNameA
LZOpenFileW
LZStart
LZSeek
CopyLZFile
LZDone
LZOpenFileA
LZCopy
LZCloseFile
LZRead
LZInit
odbc32
SQLBindParameter
SQLFreeHandle
SQLGetConnectAttrW
SQLSetConnectOption
SQLGetCursorNameA
SQLColAttributeW
SQLPrepareA
CursorLibTransact
GetODBCSharedData
SQLProcedureColumnsW
SQLForeignKeys
SQLSetConnectAttr
SQLSetStmtOption
SQLAllocHandle
SQLGetDescFieldA
SQLGetFunctions
CursorLibLockDesc
SQLPrimaryKeys
SQLGetDiagRecA
SQLAllocConnect
SQLBindCol
OpenODBCPerfData
SQLNativeSql
SQLParamData
SQLSetDescField
LockHandle
SQLForeignKeysW
SQLSetConnectOptionA
CursorLibLockDbc
SQLParamOptions
SQLColumnPrivilegesA
SQLStatisticsW
SQLSetParam
ValidateErrorQueue
SQLExecDirect
PostODBCError
ntdll
NtCreateTimer
NtAccessCheck
NtTerminateThread
NtQueryInstallUILanguage
RtlExtendedMagicDivide
sqrt
NtSetUuidSeed
RtlInsertElementGenericTable
NtResetEvent
NtImpersonateClientOfPort
RtlEnlargedIntegerMultiply
NtCreateThread
NtSetSystemPowerState
ZwSaveMergedKeys
RtlCreateTagHeap
ZwSetSystemEnvironmentValueEx
NtOpenIoCompletion
ZwContinue
NtQueryKey
RtlUnicodeToOemN
ZwQuerySystemEnvironmentValueEx
NtAccessCheckByTypeAndAuditAlarm
NtReleaseSemaphore
RtlInitializeSid
ZwDebugActiveProcess
RtlEqualDomainName
RtlSetCurrentEnvironment
ZwAccessCheckByTypeResultListAndAuditAlarm
NtAllocateLocallyUniqueId
RtlFindCharInUnicodeString
RtlIpv6AddressToStringA
ZwQueryFullAttributesFile
NtReadRequestData
__isascii
NtDisplayString
isprint
ispunct
syssetup
AsrAddSifEntryW
AsrFreeContext
AsrCreateStateFileA
AsrAddSifEntryA
SetupChangeFontSize
SetupSetDisplay
AsrCreateStateFileW
SetupInfObjectInstallActionW
AsrRestorePlugPlayRegistryData
Sections
.text Size: 188KB - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 214KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 461KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ