Static task
static1
Behavioral task
behavioral1
Sample
3d6ed581b14fdda09dbf65bb594c9629_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3d6ed581b14fdda09dbf65bb594c9629_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3d6ed581b14fdda09dbf65bb594c9629_JaffaCakes118
-
Size
135KB
-
MD5
3d6ed581b14fdda09dbf65bb594c9629
-
SHA1
6c04d718920d4156f0cfb7b4cf63ca579aa17de4
-
SHA256
f072e159f7affd4c9da4776d35f9ecba4e9e90213995bbe19892e03c64cdfb17
-
SHA512
bcf2c46caa04657ecd916ca0933a9ee3eb458f208ce1deeb43a88c902e89c7af1bc46b39956e57707cf49363b772365cd806d7d5291189003884084c303c92ab
-
SSDEEP
3072:3rCg0ya9J4AChLGfX6civ8kMvoXTWTIPVGGcy0mRAN:r0HJ4mkMmTMIdDcL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d6ed581b14fdda09dbf65bb594c9629_JaffaCakes118
Files
-
3d6ed581b14fdda09dbf65bb594c9629_JaffaCakes118.exe windows:5 windows x86 arch:x86
bffb34625b2991ee48ce860abcce29b1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
odbctrac
TraceSQLSetConnectOption
TraceSQLSetCursorName
TraceSQLSetScrollOptions
TraceSQLDataSources
TraceSQLProceduresW
TraceSQLDescribeCol
TraceSQLAllocHandle
TraceSQLSetDescFieldW
TraceSQLGetInfoW
TraceSQLGetInfo
TraceSQLForeignKeysW
TraceSQLNativeSqlW
TraceSQLCloseCursor
TraceSQLGetConnectOptionW
TraceSQLGetStmtAttr
TraceSQLGetCursorName
TraceSQLDriversW
TraceSQLTransact
TraceSQLTablesW
TraceSQLMoreResults
kernel32
GetNamedPipeHandleStateA
GetFileSize
PrivCopyFileExW
GetCurrentProcessId
WriteConsoleW
InterlockedPushEntrySList
SetCommMask
GlobalMemoryStatusEx
AllocConsole
CommConfigDialogW
PeekNamedPipe
LocalLock
GetProcessShutdownParameters
TlsSetValue
LoadLibraryA
GetConsoleProcessList
BackupSeek
GlobalCompact
SignalObjectAndWait
OpenProfileUserMapping
FindActCtxSectionStringW
GetThreadContext
OpenEventW
QueryMemoryResourceNotification
CreateFileA
EnumResourceNamesA
GetAtomNameW
SetSystemPowerState
GetConsoleCommandHistoryA
GetStartupInfoA
WriteTapemark
SetFileShortNameA
CreateHardLinkW
SetCalendarInfoW
GetWindowsDirectoryA
FindNextVolumeA
CreateHardLinkA
OpenSemaphoreW
SetLastError
GlobalAlloc
RtlFillMemory
GetFileInformationByHandle
ReplaceFileW
VirtualAlloc
mapistub
GetTnefStreamCodepage@12
MAPIAllocateBuffer
MAPIDeinitIdle@0
MNLS_lstrlenW@4
OpenStreamOnFile
LaunchWizard@20
HrGetOmiProvidersFlags
FtAddFt@16
WrapProgress@20
MAPILogoff
BMAPIResolveName
HrSzFromEntryID@12
UlPropSize@4
CreateTable@36
EncodeID@12
ScRelocNotifications@20
WrapCompressedRTFStream@12
UNKOBJ_Free@8
MAPIAllocateMore@12
OpenTnefStreamEx@32
MNLS_IsBadStringPtrW@8
sqlunirl
newWideCharFromMultiByte
_PostMessage@16
_FindAtom_@4
_GetModuleFileName@12
_ObjectDeleteAuditAlarm_@12
_TabbedTextOut_@32
_RemoveDirectory_@4
_MapVirtualKey_@8
_GetDlgItemText@16
_EnumFontFamilies_@16
_ChangeDisplaySettings_@8
_GetTextExtentPoint@16
_RegisterClipboardFormat_@4
_trename
_GetProfileSection_@12
_GetKerningPairs_@12
_DlgDirListComboBox_@20
_CreateMDIWindow_@40
_AccessCheckAndAuditAlarm_@44
_BuildCommDCB_@8
_SetWindowsHookEx_@16
_BroadcastSystemMessage_@20
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 238KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ