Static task
static1
Behavioral task
behavioral1
Sample
626402c41706419e8c3ffa1c11044e83_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
626402c41706419e8c3ffa1c11044e83_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
626402c41706419e8c3ffa1c11044e83_JaffaCakes118
-
Size
52KB
-
MD5
626402c41706419e8c3ffa1c11044e83
-
SHA1
21a3bd2b3b794df0b7bddc79960c6aa003a38965
-
SHA256
3825e00523f9545c747b22b97c46f93e8533d9863aacbfa5e6ec3ed5f35d4ec0
-
SHA512
7068f1aa307bddb47dc6185048e41f6efc84dfb1205e88df889eb1488e40830d927bb4a3370a0d24b06e3fa82cde82aaf110b6e6bae08afc404110cad3d776f0
-
SSDEEP
768:Wcqb3lffTozzNPil0nhWOwW+ZzGY5uPs6ulKh:Wcqb9cvNPgoWbzGY5eUAh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 626402c41706419e8c3ffa1c11044e83_JaffaCakes118
Files
-
626402c41706419e8c3ffa1c11044e83_JaffaCakes118.exe windows:4 windows x86 arch:x86
ba92fd277f5af9fc2848f2acf231fe69
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
Sleep
LoadLibraryA
GetWindowsDirectoryA
FreeLibrary
GetModuleFileNameA
InterlockedDecrement
InterlockedIncrement
GetModuleHandleA
WideCharToMultiByte
CreateEventA
GetCurrentThreadId
ResetEvent
SetEvent
LocalFree
WaitForSingleObject
CreateMutexA
CloseHandle
MultiByteToWideChar
GetStartupInfoA
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCloseKey
RegDeleteKeyA
RegCreateKeyA
RegSetValueExA
RegDeleteValueA
msvcp60
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Xlen@std@@YAXXZ
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
user32
GetMessageA
MessageBoxA
DispatchMessageA
PostThreadMessageA
ole32
CLSIDFromString
CoUninitialize
CoSuspendClassObjects
CoRevokeClassObject
StringFromGUID2
CoCreateGuid
CoInitializeSecurity
CoInitializeEx
CoRegisterClassObject
CoResumeClassObjects
oleaut32
SafeArrayGetLBound
VariantChangeType
SafeArrayGetUBound
SafeArrayGetElement
VariantClear
SysFreeString
VariantInit
SysAllocString
msvcrt
localtime
_ftol
_stricmp
_tzset
_wtol
_wcsicmp
_controlfp
_wcslwr
_except_handler3
__set_app_type
__CxxFrameHandler
_CxxThrowException
memmove
wcslen
??2@YAPAXI@Z
_beginthreadex
_purecall
wcsftime
_wsetlocale
mktime
iswctype
time
difftime
gmtime
_wcsupr
_exit
_XcptFilter
_wtoi
atol
isdigit
free
__dllonexit
_onexit
??1type_info@@UAE@XZ
_initterm
exit
_acmdln
__getmainargs
__p__commode
__setusermatherr
_adjust_fdiv
__p__fmode
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE