Static task
static1
Behavioral task
behavioral1
Sample
65eaa3d038b304bb1cb408b52fffefc6_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
65eaa3d038b304bb1cb408b52fffefc6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
65eaa3d038b304bb1cb408b52fffefc6_JaffaCakes118
-
Size
160KB
-
MD5
65eaa3d038b304bb1cb408b52fffefc6
-
SHA1
e8123c2659e82e338c4080d34f9ec916d60e32a0
-
SHA256
b235ca65354896d4a4cb80374ed0afa1964f6280b2bb85baf08338afe223258d
-
SHA512
02b6c2dec0ea3519957828c14c6174bd7d8042b74469a31ba3c356a11f00a4accc4e62327988f32f089a7b2851236cb1b9bcad18e367a9d41a744baccad66352
-
SSDEEP
3072:jHRwUWV0xrqj3jmjcI9LrTxmJeNpDB5KNNsbZ3sCL1c:jFF8jTNIFrTx7NL5T8CL1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65eaa3d038b304bb1cb408b52fffefc6_JaffaCakes118
Files
-
65eaa3d038b304bb1cb408b52fffefc6_JaffaCakes118.exe windows:5 windows x86 arch:x86
8fd2521153f0b7c801af602c815a48b8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
SetWindowTextW
GetDCEx
BringWindowToTop
GetWindowContextHelpId
MsgWaitForMultipleObjectsEx
EnumThreadWindows
ScrollChildren
GetLastInputInfo
MessageBoxIndirectA
RegisterServicesProcess
CharLowerBuffW
LookupIconIdFromDirectoryEx
ActivateKeyboardLayout
GetNextDlgTabItem
ShowCursor
SetWindowLongA
CreateDesktopW
CascadeWindows
CallNextHookEx
LoadBitmapA
GetInternalWindowPos
SetCursor
LoadMenuIndirectW
GetMenuItemCount
SetWindowRgn
DdeDisconnect
GetMenuContextHelpId
ShowCaret
GetTabbedTextExtentA
IsIconic
DdeQueryStringA
CloseClipboard
RealGetWindowClassW
ArrangeIconicWindows
msvcp60
??0?$numpunct@D@std@@QAE@I@Z
?denorm_min@?$numeric_limits@K@std@@SAKXZ
?lt@?$char_traits@G@std@@SA_NABG0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??Kstd@@YA?AV?$complex@N@0@ABNABV10@@Z
?setf@ios_base@std@@QAEHH@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?is_open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
??4?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
??Hstd@@YA?AV?$complex@N@0@ABV10@ABN@Z
?signaling_NaN@?$numeric_limits@K@std@@SAKXZ
?eq@?$char_traits@G@std@@SA_NABG0@Z
?_Doraise@range_error@std@@MBEXXZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?sinh@std@@YA?AV?$complex@M@1@ABV21@@Z
??Kstd@@YA?AV?$complex@O@0@ABV10@0@Z
?pow@std@@YA?AV?$complex@M@1@ABV21@H@Z
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?flush@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??_7?$moneypunct@D$0A@@std@@6B@
?round_error@?$numeric_limits@K@std@@SAKXZ
?round_error@?$numeric_limits@F@std@@SAFXZ
??0?$ctype@D@std@@QAE@PBF_NI@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAF@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PAG0IG@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
??Ystd@@YAAAV?$complex@N@0@AAV10@ABV10@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
?sin@?$_Ctr@N@std@@SANN@Z
??Gstd@@YA?AV?$complex@N@0@ABV10@@Z
??4?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?copy@?$char_traits@D@std@@SAPADPADPBDI@Z
??9std@@YA_NABOABV?$complex@O@0@@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??_7codecvt_base@std@@6B@
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?length@?$codecvt@DDH@std@@QBEHAAHPBD1I@Z
wctype
??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z
?endl@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@AAV21@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
wcrtomb
winmm
joyGetPos
mixerGetNumDevs
timeEndPeriod
mciGetErrorStringA
mmioAdvance
midiOutUnprepareHeader
waveOutGetNumDevs
mmDrvInstall
DrvGetModuleHandle
waveOutGetErrorTextW
mciGetDeviceIDFromElementIDA
joy32Message
mixerOpen
midiInUnprepareHeader
midiConnect
midiStreamPause
joyGetPosEx
midiStreamOpen
waveOutUnprepareHeader
auxGetDevCapsA
mciSetYieldProc
waveOutBreakLoop
mmioCreateChunk
waveInAddBuffer
waveOutGetPosition
mciDriverNotify
mciGetYieldProc
WOW32DriverCallback
mci32Message
mixerGetLineControlsW
mixerClose
midiInGetErrorTextW
mixerGetDevCapsW
joyConfigChanged
mmTaskSignal
mmioInstallIOProcW
joySetCapture
mciSendStringA
mciSendCommandW
waveOutGetVolume
DriverCallback
mciFreeCommandResource
CloseDriver
WOWAppExit
mixerGetControlDetailsW
kernel32
LoadLibraryA
LeaveCriticalSection
FindResourceW
EnumTimeFormatsW
IsDBCSLeadByteEx
ReadConsoleInputExA
CreateMailslotW
ReadDirectoryChangesW
DefineDosDeviceA
OpenSemaphoreA
ShowConsoleCursor
GetCommState
VirtualAlloc
GlobalFindAtomA
GetConsoleCursorMode
RtlZeroMemory
SetSystemTimeAdjustment
DeleteFileA
PrivMoveFileIdentityW
AddLocalAlternateComputerNameW
SetHandleContext
DeleteCriticalSection
CopyFileExW
lstrcmpi
CreateSemaphoreW
GlobalUnWire
EnterCriticalSection
WriteConsoleInputA
HeapReAlloc
AddLocalAlternateComputerNameA
PulseEvent
mfcsubs
??BCCriticalSection@@QAEPAU_RTL_CRITICAL_SECTION@@XZ
??8@YG_NPBGABVCString@@@Z
?AllocBeforeWrite@CString@@IAEXH@Z
?IsEmpty@CMapStringToPtr@@QBEHXZ
??0CString@@QAE@PBE@Z
??1CCriticalSection@@UAE@XZ
?Lookup@CMapStringToPtr@@QBEHPBGAAPAX@Z
?RemoveAll@CMapStringToPtr@@QAEXXZ
?AfxW2AHelper@@YGPADPADPBGH@Z
??H@YG?AVCString@@GABV0@@Z
?ConcatCopy@CString@@IAEXHPBGH0@Z
??P@YG_NPBGABVCString@@@Z
?Unlock@CCriticalSection@@UAEHXZ
?TrimRight@CString@@QAEXXZ
?FreeExtra@CStringArray@@QAEXXZ
?Release@CString@@KGXPAUCStringData@@@Z
?FormatMessageW@CString@@QAAXIZZ
?CompareNoCase@CString@@QBEHPBG@Z
?InitHashTable@CMapStringToPtr@@QAEXIH@Z
??M@YG_NABVCString@@0@Z
?TrimLeft@CString@@QAEXXZ
?CopyBeforeWrite@CString@@IAEXXZ
?ReverseFind@CString@@QBEHG@Z
?ElementAt@CStringArray@@QAEAAVCString@@H@Z
?LoadStringW@CString@@QAEHI@Z
?InsertAt@CStringArray@@QAEXHPBGH@Z
??4CString@@QAEABV0@PBD@Z
??YCString@@QAEABV0@G@Z
??1CObject@@UAE@XZ
??YCString@@QAEABV0@ABV0@@Z
?SetAt@CString@@QAEXHG@Z
?RemoveAll@CStringArray@@QAEXXZ
?GetNextAssoc@CMapStringToPtr@@QBEXAAPAU__POSITION@@AAVCString@@AAPAX@Z
??P@YG_NABVCString@@PBG@Z
??_FCMapStringToPtr@@QAEXXZ
??9@YG_NPBGABVCString@@@Z
?HashKey@CMapStringToPtr@@QBEIPBG@Z
?RemoveKey@CMapStringToPtr@@QAEHPBG@Z
?FormatMessageW@CString@@QAAXPBGZZ
query
?StopFiltering@CFilterDaemon@@QAEXXZ
?PutMaxValue@CValueNormalizer@@QAEXKAAKW4VARENUM@@@Z
?RemoveFirstChild@CDbCmdTreeNode@@IAEPAV1@XZ
??3CDbContent@@SGXPAX@Z
CIBuildQueryNode
??0CColumns@@QAE@ABV0@@Z
?PropertyToPropId@CStandardPropMapper@@QAEKABVCFullPropSpec@@H@Z
??1CContentRestriction@@QAE@XZ
?QuerySdidLookupTable@CiStorage@@QAEPAVPRcovStorageObj@@K@Z
?GetDiskSpace@CDriveInfo@@QAEXAA_J0@Z
??0CRcovStrmMDTrans@@QAE@AAVPRcovStorageObj@@W4MDOp@0@K@Z
??0CAllocStorageVariant@@QAE@W4VARENUM@@KAAVPMemoryAllocator@@@Z
??0CDbSortSet@@QAE@I@Z
?FastInit@CPropStoreManager@@QAEXPAVCiStorage@@@Z
?SetColumn@CCatState@@QAEXPBGI@Z
??1CDbSortSet@@QAE@XZ
?SetBSTR@CStorageVariant@@QAEXPAGI@Z
??1COccRestriction@@QAE@XZ
??0CNodeRestriction@@QAE@KI@Z
?QueryCatalogEnum@CMachineAdmin@@QAEPAVCCatalogEnum@@XZ
?VT_VARIANT_NE@@YGHABUtagPROPVARIANT@@0@Z
?GetNumber@CQueryScanner@@QAEHAAKAAH@Z
?Release@CEnumWorkid@@UAGKXZ
?Marshall@CNatLanguageRestriction@@QBEXAAVPSerStream@@@Z
??1CCatalogEnum@@QAE@XZ
??0CPropStoreManager@@QAE@K@Z
??1?$XPtr@VCDbColumnNode@@@@QAE@XZ
?ExtensionHasScriptMap@CMetaDataMgr@@QAEHPBG@Z
?AddRef@CEnumString@@UAGKXZ
??1CPropertyList@@UAE@XZ
?UnMarshall@CDbContentVector@@QAEHAAVPDeSerStream@@@Z
??1CNotRestriction@@QAE@XZ
?MakeMetadataICommand@@YGJPAPAUIUnknown@@W4CiMetaData@@PBG2PAU1@@Z
?CreateSubdirs@CMachineAdmin@@QAEXPBG@Z
?Empty@CRcovStrmWriteTrans@@QAEXXZ
?IsStopped@CCatalogAdmin@@QAEHXZ
?Serialize@CDbQueryResults@@QBEXAAVPSerStream@@@Z
?IsWaitingForDocument@CFilterDaemon@@QAEHXZ
?SetRestriction@CDbSelectNode@@QAEHPAVCDbCmdTreeNode@@@Z
?PeekULong@CMemDeSerStream@@UAEKXZ
?GetPropInfoFromId@CEmptyPropertyList@@UAGJPBUtagDBID@@PAPAGPAGPAI@Z
perfdisk
CollectDiskObjectData
CloseDiskObject
OpenDiskObject
wship6
WSHNotify
WSHOpenSocket
WSHGetProviderGuid
WSHAddressToString
WSHGetSocketInformation
WSHOpenSocket2
WSHGetSockaddrType
WSHGetWSAProtocolInfo
WSHSetSocketInformation
WSHJoinLeaf
WSHEnumProtocols
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHStringToAddress
WSHIoctl
Sections
.text Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 241KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ