Static task
static1
Behavioral task
behavioral1
Sample
711e68629051adddd99b769c417c65e0_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
711e68629051adddd99b769c417c65e0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
711e68629051adddd99b769c417c65e0_JaffaCakes118
-
Size
60KB
-
MD5
711e68629051adddd99b769c417c65e0
-
SHA1
9ae51813afdf0d9253e9a5a9fa90c7e9e6bf1ae8
-
SHA256
ab5f7e6addb5fa9e21a38b30451df8e986df8c62a41dbf9c9ef80793f52d646c
-
SHA512
38c454a500e1a89d5e077120c97139dad24fb4adcc59afe88182d6148f254b8ce9a444aeb54461e415f592c7753c4dd7d627093e23f9462e98f915cb4dff391e
-
SSDEEP
768:BpdTU2xpSQZgC6zjO3SJ5viboFlNd8mwHZy068n3rSzZ3pTkYnPijUWOidChtVqB:BpjM838pneVNplLVm+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 711e68629051adddd99b769c417c65e0_JaffaCakes118
Files
-
711e68629051adddd99b769c417c65e0_JaffaCakes118.exe windows:4 windows x86 arch:x86
f9a8f80e4bf9060c393ab99bf24c97f5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
OpenProcess
lstrlenW
MultiByteToWideChar
Sleep
TerminateProcess
CreateProcessA
WinExec
CreateThread
WideCharToMultiByte
lstrcatA
lstrcpyA
GetShortPathNameA
GetModuleFileNameA
CreateDirectoryA
GetTempPathA
InterlockedDecrement
GetFileSize
WriteFile
ReadFile
GetLastError
LocalFree
GetStartupInfoA
CreateRemoteThread
WaitForSingleObject
VirtualFreeEx
CreateToolhelp32Snapshot
Process32First
GetSystemDirectoryA
Process32Next
CopyFileA
DeleteFileA
CreateFileA
CloseHandle
GetEnvironmentVariableA
user32
CharLowerA
wsprintfW
advapi32
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
shell32
ShellExecuteA
ole32
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
StringFromCLSID
oleaut32
VariantClear
SysFreeString
SysAllocStringLen
SysAllocString
LoadTypeLi
wininet
HttpQueryInfoA
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
urlmon
URLDownloadToFileA
netapi32
Netbios
msvcp60
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
msvcrt
_XcptFilter
_exit
??1type_info@@UAE@XZ
wcslen
free
_itoa
srand
exit
memcpy
strcat
_CxxThrowException
time
atol
atoi
fopen
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__dllonexit
_onexit
_controlfp
_strnicmp
rand
_stricmp
_except_handler3
sprintf
strcpy
strlen
memset
strstr
__CxxFrameHandler
strncmp
??2@YAPAXI@Z
strcmp
strtok
fwrite
fclose
fgets
Sections
.text Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE