Static task
static1
Behavioral task
behavioral1
Sample
59c8311193d5daaad572d02141067a93_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
59c8311193d5daaad572d02141067a93_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
59c8311193d5daaad572d02141067a93_JaffaCakes118
-
Size
96KB
-
MD5
59c8311193d5daaad572d02141067a93
-
SHA1
dd7ef5e5aaf74fbfb284f9e96b83066a2f107529
-
SHA256
416d7ac9e4b2447cd54a3d90a49f81ede842bff44a1512f0a7d1882ce3909ad3
-
SHA512
0ba7097554d399bacd042eb9dc6dac2cc26b3968d5337c37075077335681cfd1fe7e37ba2a26a91e0823e85f4e073fe18608cf2fdd902b9276bfd76e5dba7d3e
-
SSDEEP
1536:7yX7KwHNwfnmfJgLMXYETXtfuJ2atLKPKaIPwDBsxiGzlezKVCPNb2:7yrvHNwf+JgIrXtDatLKPKpPQqxtpuK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 59c8311193d5daaad572d02141067a93_JaffaCakes118
Files
-
59c8311193d5daaad572d02141067a93_JaffaCakes118.exe windows:4 windows x86 arch:x86
21d67a1f5463dcaacc6f79346d56d050
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryA
CloseHandle
CreateFileA
CopyFileA
WaitForSingleObject
GetModuleHandleA
OpenProcess
WinExec
GetLastError
TerminateProcess
InterlockedDecrement
CreateProcessA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
GetTempPathA
DebugBreak
OutputDebugStringA
GetFileSize
WriteFile
ReadFile
InterlockedIncrement
CreateDirectoryA
CreateThread
GetStartupInfoA
LocalFree
WideCharToMultiByte
lstrlenW
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
MultiByteToWideChar
lstrcmpiA
lstrlenA
lstrcatA
lstrcpyA
Sleep
user32
wvsprintfA
CharLowerA
CharNextA
LoadStringA
advapi32
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
StartServiceA
CloseServiceHandle
ControlService
RegSetValueExA
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
shell32
ShellExecuteA
SHGetSpecialFolderPathA
ole32
CoCreateGuid
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree
StringFromCLSID
oleaut32
VariantClear
SysFreeString
SysAllocStringLen
SysAllocString
LoadTypeLi
wininet
InternetGetConnectedState
InternetOpenA
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetCloseHandle
urlmon
URLDownloadToFileA
netapi32
Netbios
msvcp60
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??_7out_of_range@std@@6B@
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
msvcrt
_ismbcdigit
wcslen
time
atol
_itoa
strcat
atoi
strcmp
strncmp
memset
rand
srand
strtok
free
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__dllonexit
_onexit
_strnicmp
_strlwr
fgets
_controlfp
_mbsrchr
_snprintf
__CxxFrameHandler
strlen
strstr
??2@YAPAXI@Z
??0exception@@QAE@ABV0@@Z
_CxxThrowException
memcpy
_ismbcspace
memmove
_mbschr
_mbsstr
fclose
fflush
fwrite
fopen
_except_handler3
sprintf
strcpy
Sections
.text Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE