Static task
static1
Behavioral task
behavioral1
Sample
5be6028f87f8441b73d058173899f7e5_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5be6028f87f8441b73d058173899f7e5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5be6028f87f8441b73d058173899f7e5_JaffaCakes118
-
Size
826KB
-
MD5
5be6028f87f8441b73d058173899f7e5
-
SHA1
ea3aafbfae86044552b62cf11719109c3f3116de
-
SHA256
f17689c481ded7d532f534d10d7414b0ccfca13a454129fa38023ca1b23e8017
-
SHA512
54f6d4ff16784e1a68a43cbe358451a84d0f0ed7a7b83a625946fc1de18abaf5c01036daa804a45ae662d6f4998f09807ac4db52b81c875ee6edd1c0d5ec8e77
-
SSDEEP
12288:wszxi5fs5b6nm0/qiX+EOgExxdUDTOrxjZVETdtn85v8BsAAL:H6nmajNOUDTExzWdu5v8mA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5be6028f87f8441b73d058173899f7e5_JaffaCakes118
Files
-
5be6028f87f8441b73d058173899f7e5_JaffaCakes118.exe windows:5 windows x86 arch:x86
8229feb1b9e4e546b187222e62c0ab25
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetTimeFromSystemTimeA
DeleteUrlCacheContainerW
GetUrlCacheEntryInfoExW
InternetSetFilePointer
IsUrlCacheEntryExpiredA
SetUrlCacheEntryInfoA
InternetQueryOptionW
InternetSetCookieExW
FindNextUrlCacheEntryExW
SetUrlCacheGroupAttributeW
RetrieveUrlCacheEntryStreamA
InternetGetCertByURL
HttpAddRequestHeadersW
ShowX509EncodedCertificate
FtpGetFileW
InternetCheckConnectionW
DeleteUrlCacheGroup
InternetFortezzaCommand
FtpOpenFileW
InternetFindNextFileA
InternetAutodialCallback
FtpPutFileA
GetUrlCacheEntryInfoW
UnlockUrlCacheEntryFile
InternetGoOnlineA
InternetClearAllPerSiteCookieDecisions
IsHostInProxyBypassList
FtpPutFileW
FindNextUrlCacheEntryW
InternetTimeToSystemTimeW
SetUrlCacheEntryInfoW
ShowClientAuthCerts
CreateUrlCacheGroup
FtpSetCurrentDirectoryW
FindFirstUrlCacheContainerA
HttpQueryInfoA
InternetGetLastResponseInfoA
InternetSetCookieA
GopherGetAttributeW
FtpPutFileEx
ParseX509EncodedCertificateForListBoxEntry
SetUrlCacheEntryGroup
FindNextUrlCacheContainerW
FindFirstUrlCacheEntryExW
GopherOpenFileW
HttpCheckDavCompliance
SetUrlCacheEntryGroupW
InternetGetConnectedState
InternetQueryOptionA
InternetGetCookieExW
DeleteIE3Cache
InternetSetStatusCallback
InternetTimeFromSystemTime
InternetGetCookieW
InternetConnectW
RetrieveUrlCacheEntryFileW
HttpAddRequestHeadersA
GetUrlCacheConfigInfoA
FtpCommandA
InternetReadFileExA
InternetGetPerSiteCookieDecisionW
InternetDialA
InternetAlgIdToStringA
InternetSetOptionA
RegisterUrlCacheNotification
FindNextUrlCacheGroup
FtpRenameFileA
InternetLockRequestFile
PrivacySetZonePreferenceW
FindFirstUrlCacheEntryA
InternetTimeToSystemTime
CreateUrlCacheEntryA
kernel32
DebugActiveProcess
GetWindowsDirectoryW
BaseCleanupAppcompatCacheSupport
CreatePipe
GetFirmwareEnvironmentVariableW
WaitForSingleObjectEx
_hwrite
GetConsoleAliasExesW
GetConsoleTitleW
SetThreadPriority
GetSystemWindowsDirectoryA
GetFileTime
GetCommProperties
Module32FirstW
GetTempFileNameW
GetSystemTimeAsFileTime
SetWaitableTimer
LoadResource
SetClientTimeZoneInformation
GetCurrencyFormatW
BindIoCompletionCallback
GetConsoleAliasesW
GetProcessPriorityBoost
EnumResourceLanguagesA
DosDateTimeToFileTime
HeapLock
Process32NextW
CallNamedPipeA
LoadLibraryA
GlobalFix
GlobalFindAtomA
GetComputerNameExW
BaseUpdateAppcompatCache
GetConsoleAliasesLengthW
GetHandleInformation
GetPrivateProfileStructA
lstrcpynW
DefineDosDeviceA
IsDBCSLeadByte
GetCurrentProcessId
VirtualAlloc
SetEndOfFile
GetPrivateProfileIntW
SetConsoleCursor
IsBadCodePtr
QueryDosDeviceW
polstore
IPSecEnumFilterData
IPSecFreeNFAData
IPSecFreePolStr
IPSecDeleteNegPolData
IPSecOpenPolicyStore
IPSecFreeNegPolData
IPSecCopyISAKMPData
IPSecFreeFilterSpecs
IPSecCreateISAKMPData
IPSecSetPolicyData
IPSecSetNegPolData
IPSecCreateNegPolData
IPSecDeleteISAKMPData
IPSecClosePolicyStore
IPSecExportPolicies
IPSecFreeMulNegPolData
IPSecFreeISAKMPData
IPSecDeleteFilterData
IPSecAllocPolStr
IPSecEnumPolicyData
IPSecFreeMulPolicyData
IPSecGetNegPolData
IPSecImportPolicies
IPSecGetAssignedPolicyData
IPSecGetFilterData
IPSecUnassignPolicy
IPSecFreeMulISAKMPData
IPSecFreeFilterData
IPSecSetFilterData
IPSecSetNFAData
IPSecCopyNFAData
IPSecFreeMulFilterData
IPSecFreeFilterSpec
IPSecCreatePolicyData
mfcsubs
?ConcatCopy@CString@@IAEXHPBGH0@Z
??0CString@@QAE@ABV0@@Z
?FormatMessageW@CString@@QAAXIZZ
??8@YG_NPBGABVCString@@@Z
??ACString@@QBEGH@Z
?GetBuffer@CString@@QAEPAGH@Z
??P@YG_NPBGABVCString@@@Z
?GetAt@CStringArray@@QBE?AVCString@@H@Z
?GetNextAssoc@CMapStringToPtr@@QBEXAAPAU__POSITION@@AAVCString@@AAPAX@Z
?Find@CString@@QBEHG@Z
?AfxExtractSubString@@YGHAAVCString@@PBGHG@Z
??P@YG_NABVCString@@0@Z
??8@YG_NABVCString@@PBG@Z
??ACMapStringToPtr@@QAEAAPAXPBG@Z
??4CPlex@@QAEAAU0@ABU0@@Z
?Copy@CStringArray@@QAEXABV1@@Z
?GetStartPosition@CMapStringToPtr@@QBEPAU__POSITION@@XZ
??1CObject@@UAE@XZ
??0CString@@QAE@PBG@Z
??H@YG?AVCString@@ABV0@G@Z
?ReverseFind@CString@@QBEHG@Z
?data@CPlex@@QAEPAXXZ
?AllocBuffer@CString@@IAEXH@Z
??0CString@@QAE@PBE@Z
??_7CObject@@6B@
?FindOneOf@CString@@QBEHPBG@Z
?Lock@CCriticalSection@@QAEHXZ
?GetData@CStringArray@@QBEPBVCString@@XZ
?Release@CString@@KGXPAUCStringData@@@Z
??0CObject@@IAE@XZ
?Format@CString@@QAAXIZZ
?GetAllocLength@CString@@QBEHXZ
?AfxGetEmptyString@@YGABVCString@@XZ
??4CString@@QAEABV0@PBG@Z
??0CString@@QAE@PBGH@Z
?Collate@CString@@QBEHPBG@Z
??9@YG_NPBGABVCString@@@Z
??1CStringArray@@UAE@XZ
?Init@CString@@IAEXXZ
?FormatMessageW@CString@@QAAXPBGZZ
??_7CSyncObject@@6B@
?Unlock@CCriticalSection@@UAEHXZ
msvcp60
?uncaught_exception@std@@YA_NXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?ldexp@?$_Ctr@M@std@@SAMMH@Z
?copy@?$char_traits@G@std@@SAPAGPAGPBGI@Z
?close@?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAEPAV12@XZ
?sinh@std@@YA?AV?$complex@M@1@ABV21@@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??1?$moneypunct@D$00@std@@UAE@XZ
?underflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??8std@@YA_NABV?$complex@N@0@0@Z
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
?pbackfail@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAEGG@Z
?infinity@?$numeric_limits@O@std@@SAOXZ
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBGI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z
?curr_symbol@?$_Mpunct@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
??4?$_Complex_base@N@std@@QAEAAV01@ABV01@@Z
?sqrt@?$_Ctr@N@std@@SANN@Z
?_Getctype@_Locinfo@std@@QBE?AU_Ctypevec@@XZ
?sync@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEHXZ
??0?$collate@D@std@@QAE@I@Z
?abs@std@@YAOABV?$complex@O@1@@Z
?exceptions@ios_base@std@@QAEXF@Z
??4?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEAAV01@ABV01@@Z
??4?$complex@O@std@@QAEAAV01@ABO@Z
??1?$basic_ofstream@GU?$char_traits@G@std@@@std@@UAE@XZ
??_7?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
?do_compare@?$collate@G@std@@MBEHPBG000@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAF@Z
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
_FDscale
?atan2@?$_Ctr@O@std@@SAOOO@Z
ole32
OleCreateLink
PropSysFreeString
IsValidIid
CoPushServiceDomain
CoMarshalHresult
OleCreateLinkToFileEx
CoAllowSetForegroundWindow
OleCreateFromFile
CreateObjrefMoniker
UtGetDvtd32Info
CoResumeClassObjects
CoRegisterMessageFilter
HMENU_UserMarshal
HBITMAP_UserUnmarshal
MkParseDisplayName
OleConvertOLESTREAMToIStorage
OleSetAutoConvert
ReadClassStg
CreateDataCache
StgCreatePropSetStg
CoFileTimeNow
HDC_UserFree
HMETAFILE_UserUnmarshal
CoGetTreatAsClass
OleFlushClipboard
OleGetAutoConvert
CoCreateInstanceEx
CLSIDFromOle1Class
mscat32
CryptCATPutAttrInfo
MsCatFreeHashTag
CryptCATHandleFromStore
CryptCATAdminEnumCatalogFromHash
DllRegisterServer
CryptCATCDFClose
CryptCATCDFEnumMembersByCDFTagEx
CryptCATGetMemberInfo
CryptCATStoreFromHandle
CryptCATCDFEnumMembers
CryptCATGetAttrInfo
CryptCATEnumerateAttr
CryptCATVerifyMember
DllUnregisterServer
CryptCATCDFEnumAttributes
CryptCATCDFOpen
CryptCATCatalogInfoFromContext
CryptCATEnumerateCatAttr
MsCatConstructHashTag
CatalogCompactHashDatabase
CryptCATPutCatAttrInfo
CryptCATCDFEnumCatAttributes
IsCatalogFile
CryptCATPutMemberInfo
CryptCATAdminCalcHashFromFileHandle
CryptCATClose
CryptCATAdminAcquireContext
CryptCATOpen
CryptCATPersistStore
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 262KB - Virtual size: 261KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 533KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ