Static task
static1
Behavioral task
behavioral1
Sample
341ce46b4219d5cad86c00d0a4659a58_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
341ce46b4219d5cad86c00d0a4659a58_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
341ce46b4219d5cad86c00d0a4659a58_JaffaCakes118
-
Size
936KB
-
MD5
341ce46b4219d5cad86c00d0a4659a58
-
SHA1
39235511a7e117fc96407cbfd7128aa535b2baf9
-
SHA256
3b45ab9c2a09ac3560244cf6fe5ccb2e248a7792ed3d115873e1462ec49a4deb
-
SHA512
58929eb80b8a44adca21c14fc16305efb391148d07526211a22569d947be24e04a5511fc15d33ebfff357530d2a1cf77a34fd746afb04d3130c6ca8b2ff37f6d
-
SSDEEP
6144:Gr2iqDXm9Tl1lvgoBahdkgu2OnwI7GTznR8Lp9j15QaeL:w7sm1LlIowh6gYsTCxKaeL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 341ce46b4219d5cad86c00d0a4659a58_JaffaCakes118
Files
-
341ce46b4219d5cad86c00d0a4659a58_JaffaCakes118.exe windows:4 windows x86 arch:x86
0402cdb6871a3bd97c0624a6ea3f91e1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFileExistsA
wininet
FindCloseUrlCache
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
DeleteUrlCacheEntry
mfc42
ord795
ord4275
ord5875
ord6453
ord2379
ord6880
ord2864
ord3573
ord3402
ord567
ord6215
ord2078
ord4299
ord4673
ord1988
ord939
ord858
ord4129
ord537
ord5355
ord5356
ord690
ord800
ord5808
ord5204
ord3229
ord1228
ord540
ord389
ord6059
ord4274
ord2764
ord924
ord926
ord860
ord2818
ord5186
ord354
ord4160
ord4278
ord6663
ord535
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord815
ord4277
ord5442
ord2919
ord3318
ord561
ord1200
ord3227
ord3408
ord3758
ord3810
ord1105
ord5856
ord2621
ord1134
ord801
ord609
ord790
ord818
ord2725
ord3693
ord3619
ord668
ord2770
ord356
ord6648
ord859
ord2915
ord355
ord541
ord3721
ord5683
ord5710
ord1168
ord2135
ord2301
ord2370
ord2358
ord2302
ord6197
ord6380
ord3092
ord6111
ord755
ord470
ord6199
ord2642
ord640
ord323
ord6605
ord5981
ord2860
ord4224
ord1640
ord5785
ord6282
ord4694
ord3054
ord941
ord6883
ord1989
ord703
ord403
ord2086
ord2575
ord4396
ord3574
ord1146
ord3716
ord6283
ord6877
ord5572
ord6930
ord4202
ord3742
ord2688
ord809
ord2614
ord556
ord1088
ord2122
ord3874
ord3797
ord6358
ord1175
ord2859
ord6928
ord6779
ord539
ord1187
ord1949
ord4034
ord2366
ord1791
ord5810
ord5481
ord2031
ord4411
ord4335
ord4863
ord4975
ord966
ord605
ord278
ord5796
ord5478
ord4919
ord1576
ord610
ord287
ord4447
ord5857
ord3500
ord1639
ord2449
ord1971
ord6139
ord936
ord928
ord1638
ord268
ord1270
ord1169
ord1567
ord1083
ord2077
ord5934
ord4424
ord5290
ord1776
ord6055
ord2414
ord3626
ord3571
ord3663
ord353
ord6385
ord1979
ord665
ord1641
ord2452
ord823
ord1871
ord825
ord6334
ord4853
ord4234
ord2362
ord641
ord324
ord3597
ord4425
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4710
ord4998
ord4376
ord5265
ord922
ord2029
msvcrt
_ltoa
strcat
_itoa
sprintf
_mbsstr
rand
_mbscmp
pow
tolower
ceil
_purecall
??1type_info@@UAE@XZ
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_setmbcp
_controlfp
abs
memcpy
memset
__CxxFrameHandler
atoi
strlen
strcpy
strrchr
remove
_mbsicmp
atof
exit
_ftol
sqrt
sin
cos
atan
free
malloc
strstr
strcmp
tan
kernel32
Sleep
FindClose
FindNextFileA
FindFirstFileA
LocalFree
RemoveDirectoryA
SetFileAttributesA
lstrlenA
MultiByteToWideChar
LoadLibraryA
lstrcpyA
WinExec
lstrcatA
GetVersionExA
GetCurrentProcess
GetModuleHandleA
GetVolumeInformationA
lstrlenW
WideCharToMultiByte
GetTickCount
HeapAlloc
GetProcessHeap
HeapFree
GetStartupInfoA
GetProcAddress
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
GlobalSize
GetLastError
SetLastError
GlobalReAlloc
CreateDirectoryA
GetModuleFileNameA
CreateSemaphoreA
FreeResource
CloseHandle
WriteFile
SizeofResource
CreateFileA
LockResource
LoadResource
FindResourceA
CopyFileA
FreeLibrary
LocalAlloc
user32
SetCursorPos
LoadCursorA
InflateRect
MessageBeep
SetCursor
LoadIconA
GetFocus
KillTimer
SetTimer
keybd_event
IsIconic
EnableWindow
GetSysColor
InvalidateRect
GetWindowRect
GetParent
FillRect
DispatchMessageA
PeekMessageA
WaitMessage
IsWindow
GetSystemMetrics
SetParent
WindowFromPoint
TranslateMessage
GetMessageA
GetClientRect
SendMessageA
PostMessageA
ChangeDisplaySettingsA
EnumDisplaySettingsA
SystemParametersInfoA
SetWindowPos
RegisterHotKey
SetWindowLongA
GetWindowLongA
IsRectEmpty
GetForegroundWindow
mouse_event
GetDC
ReleaseDC
DrawIcon
SetForegroundWindow
SetActiveWindow
SetFocus
GetCursorPos
gdi32
GetTextExtentPoint32A
CreateFontIndirectA
GetPixel
CreateFontA
CreateDCA
CreateCompatibleBitmap
BitBlt
CreatePen
CreateSolidBrush
GetStockObject
CreateDIBitmap
GetObjectA
CreateDIBSection
DeleteObject
SetDIBits
GetDIBits
CreateCompatibleDC
SelectObject
GetDIBColorTable
DeleteDC
GetDeviceCaps
advapi32
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueA
RegCloseKey
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysAllocStringLen
SysFreeString
wsock32
htons
WSASetLastError
WSAGetLastError
ioctlsocket
inet_addr
WSAStartup
WSACleanup
ntohs
listen
select
getpeername
gethostbyname
msvcp60
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z
?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?fail@ios_base@std@@QBE_NXZ
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
Sections
.text Size: 204KB - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 832KB - Virtual size: 831KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ