Static task
static1
Behavioral task
behavioral1
Sample
30d8fbf85514cd130ab7f5b660cdff83_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
30d8fbf85514cd130ab7f5b660cdff83_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
30d8fbf85514cd130ab7f5b660cdff83_JaffaCakes118
-
Size
860KB
-
MD5
30d8fbf85514cd130ab7f5b660cdff83
-
SHA1
307ed6f015b94c446af78851166db2cf3dd4bbab
-
SHA256
cc0c950d6c8d3a501ed542508652cee9315aeb3525ba1ebaae90264218c90ee6
-
SHA512
05c8d336093c915f2e8d75ee30d4cbd59b01cea1cbe15e2c1938ee57c07014682e7f739ee709a82fd2cf267d0037986ec6655c7c769739736878c4f7180b863d
-
SSDEEP
24576:quZRKko+ctqFfOfomh3o6YSYXKiaW9F8xj:/MkfsfLxh9WP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30d8fbf85514cd130ab7f5b660cdff83_JaffaCakes118
Files
-
30d8fbf85514cd130ab7f5b660cdff83_JaffaCakes118.exe windows:5 windows x86 arch:x86
3a9e28b03a6df0507945848f08283382
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsValidCodePage
AssignProcessToJobObject
GetCurrentProcessId
SetConsoleTextAttribute
GetBinaryTypeA
LoadLibraryA
VirtualAlloc
GetStartupInfoW
IsBadHugeWritePtr
GetConsoleCommandHistoryLengthA
FindFirstFileA
EnumTimeFormatsA
SwitchToFiber
FreeLibrary
ContinueDebugEvent
LocalShrink
GetEnvironmentVariableW
GetSystemDefaultLCID
lstrcatW
LZOpenFileA
LeaveCriticalSection
GetSystemTimeAdjustment
GetCommandLineA
GetModuleHandleW
DnsHostnameToComputerNameA
GetFirmwareEnvironmentVariableA
WaitForSingleObject
CreateMemoryResourceNotification
CreateEventW
GetComputerNameExW
SetFilePointerEx
ReleaseMutex
ReadFileScatter
GetUserDefaultLCID
GetVolumeInformationW
GetNamedPipeHandleStateW
EnterCriticalSection
FindNextVolumeW
SetHandleCount
GetConsoleMode
GetSystemWindowsDirectoryW
GetComPlusPackageInstallStatus
IsDBCSLeadByte
SetThreadContext
SetConsoleCursorInfo
IsBadReadPtr
GetVersionExW
GetEnvironmentStringsA
GetQueuedCompletionStatus
IsValidLocale
IsDebuggerPresent
msvcp60
?min@?$numeric_limits@D@std@@SADXZ
??0strstream@std@@QAE@PADHH@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIPBGI@Z
??0locale@std@@AAE@PAV_Locimp@01@@Z
??4?$numeric_limits@J@std@@QAEAAV01@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
?id@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?assign@?$char_traits@G@std@@SAXAAGABG@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@PBDH@Z
?cos@std@@YA?AV?$complex@N@1@ABV21@@Z
??_F?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Nstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Cosh@?$_Ctr@M@std@@SAMMM@Z
??_Fctype_base@std@@QAEXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBF@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@N@Z
?pbackfail@strstreambuf@std@@MAEHH@Z
??0?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?setstate@ios_base@std@@QAEXF@Z
?denorm_min@?$numeric_limits@M@std@@SAMXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z
??Gstd@@YA?AV?$complex@N@0@ABNABV10@@Z
?infinity@?$numeric_limits@I@std@@SAIXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?cosh@std@@YA?AV?$complex@M@1@ABV21@@Z
?_Init@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADPADD@Z
??4_Timevec@std@@QAEAAV01@ABV01@@Z
crtdll
_CIpow
_beginthread
wcsxfrm
_findclose
_amsg_exit
__pxcptinfoptrs
_CItan
_mbsstr
_mbsnextc
_getdrive
ungetwc
memcpy
_ismbbkana
_clearfp
_CIlog
_mbsrev
_controlfp
_tzname
_mbctype
srand
_winminor_dll
_mbctohira
_ultoa
tanh
_spawnvp
setlocale
fseek
__fpecode
realloc
_ismbbtrail
__threadhandle
_strninc
_mbscmp
_ltow
vfwprintf
_tell
sqlsrv32
SQLGetData
SQLDescribeColW
SQLDescribeParam
SQLExecute
SQLExtendedFetch
SQLSetCursorNameW
BCP_collen
ConfigDriverW
BCP_setcolfmt
SQLFreeHandle
SQLSetPos
BCP_moretext
SQLRowCount
SQLBindParameter
SQLSetStmtAttrW
SQLGetFunctions
SQLDebug
SQLNumParams
SQLGetStmtAttrW
ConnectDlgProc
SQLParamData
WizDatabaseDlgProc
SQLPutData
SQLAllocHandle
SQLGetTypeInfoW
SQLGetEnvAttr
SQLGetDescRecW
SQLColumnPrivilegesW
BCP_sendrow
SQLFetch
SQLProceduresW
SQLGetDiagFieldW
lz32
LZOpenFileA
LZRead
LZStart
LZCopy
LZCloseFile
LZInit
LZSeek
LZCreateFileW
CopyLZFile
LZOpenFileW
GetExpandedNameA
LZDone
LZClose
Sections
.text Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 214KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 469KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ