Static task
static1
Behavioral task
behavioral1
Sample
74fc213e7c4be47056e171ec7cbb96a2_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
74fc213e7c4be47056e171ec7cbb96a2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
74fc213e7c4be47056e171ec7cbb96a2_JaffaCakes118
-
Size
192KB
-
MD5
74fc213e7c4be47056e171ec7cbb96a2
-
SHA1
9954064fc5006f95b83afe4df59bc814d10c12d2
-
SHA256
acdecfc7f73212142e4ae4869bd57714f2cf53040ea1f51700bb0ada9d90ea18
-
SHA512
346021c83c65e3d33d7cc8567fbc73f35e7b5302f396953ee1b3eed31c07c56fb3aa1b828288558b1a742b4851fb070645888fc6910404a5065951fc4bf283da
-
SSDEEP
3072:/h28alwIXB+wA3VURbI/hyqdvlpWXUM7bMMZeT8OYBdUwd3YiU2C:528alwIXkb3VUJqlpNMc+eYBh62C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 74fc213e7c4be47056e171ec7cbb96a2_JaffaCakes118
Files
-
74fc213e7c4be47056e171ec7cbb96a2_JaffaCakes118.exe windows:4 windows x86 arch:x86
f5d3a20debab7a31cd42092bb287a0c2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
inet_ntoa
inet_addr
WSAStartup
sendto
socket
htons
htonl
closesocket
iphlpapi
GetAdaptersInfo
kernel32
lstrlenA
WideCharToMultiByte
lstrlenW
GetProcAddress
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
Sleep
FlushInstructionCache
GetCurrentProcess
HeapFree
GetProcessHeap
HeapAlloc
RaiseException
SetEvent
ResetEvent
CloseHandle
CreateEventW
WaitForMultipleObjects
DeleteTimerQueueTimer
CreateTimerQueueTimer
SetUnhandledExceptionFilter
SetErrorMode
SetEnvironmentVariableW
GetEnvironmentVariableW
WaitForSingleObject
GetCurrentThreadId
OpenMutexW
TerminateThread
CreateThread
CreateMutexW
SizeofResource
MultiByteToWideChar
LoadResource
FindResourceW
FindResourceExW
GetModuleHandleW
GetVolumeInformationA
GetTickCount
WritePrivateProfileStringA
GetPrivateProfileStringA
GetSystemDirectoryA
GetFileAttributesW
MoveFileW
DeleteFileW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
ExitProcess
GetStartupInfoW
FreeLibrary
GetModuleHandleA
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
InitializeCriticalSection
DeleteCriticalSection
GetPrivateProfileIntW
GetPrivateProfileStringW
GetModuleFileNameW
GetLastError
GetVersionExW
LocalFree
GetThreadLocale
GetLocaleInfoA
GetACP
LockResource
InterlockedExchange
user32
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
IsWindow
PostMessageW
PostThreadMessageW
TrackMouseEvent
MoveWindow
GetDesktopWindow
GetParent
GetWindow
SystemParametersInfoW
MapWindowPoints
SetWindowPos
InvalidateRect
PeekMessageW
IsWindowEnabled
DestroyWindow
ShowWindow
CallWindowProcW
GetWindowLongW
DefWindowProcW
FindWindowW
IsWindowVisible
PostQuitMessage
UpdateLayeredWindow
CreateWindowExW
EqualRect
IsRectEmpty
KillTimer
SetTimer
GetClientRect
GetWindowRect
SendMessageW
SetWindowLongW
BeginPaint
EndPaint
gdi32
BitBlt
CreateDIBSection
CreateCompatibleDC
DeleteDC
DeleteObject
SelectObject
advapi32
RegQueryValueExW
RegOpenKeyExW
ole32
OleUninitialize
OleCreate
OleSetContainedObject
CoCreateInstance
OleRun
OleInitialize
CoUninitialize
CoInitialize
OleDraw
oleaut32
VariantChangeType
VariantCopy
VariantInit
DispCallFunc
VariantClear
SysStringLen
LoadTypeLi
LoadRegTypeLi
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
GetErrorInfo
atl71
ord23
ord64
ord40
ord48
ord47
ord42
ord45
ord44
ord43
ord61
ord27
ord32
ord31
ord58
ord54
ord11
ord10
ord65
ord66
ord28
comctl32
InitCommonControlsEx
msvcp71
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Nomemory@std@@YAXXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHPBG@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?clear@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
msvcr71
_itoa
??3@YAXPAX@Z
_CxxThrowException
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_purecall
time
_time64
rand
srand
memmove
_vscwprintf
vswprintf
_except_handler3
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_set_purecall_handler
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
_set_error_mode
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_set_new_mode@@YAHH@Z
_wcsicmp
_wtoi
wcsstr
sprintf
strrchr
wcscpy
_ultoa
atol
wcsncpy
wcscat
wcsrchr
memset
_callnewh
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
_amsg_exit
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__security_error_handler
_controlfp
malloc
??_V@YAXPAX@Z
free
__CxxFrameHandler
wcslen
Sections
.text Size: 128KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ