Static task
static1
Behavioral task
behavioral1
Sample
93ebc69b8da5a0d814b8b83700d87f80_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
93ebc69b8da5a0d814b8b83700d87f80_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
93ebc69b8da5a0d814b8b83700d87f80_JaffaCakes118
-
Size
61KB
-
MD5
93ebc69b8da5a0d814b8b83700d87f80
-
SHA1
9d15b1d97a435b4a1217c4d8b1d66d453d2c0891
-
SHA256
ae5990cfd38d0cce027a91b0ebc60a779448c3943563782bfafbf1c96379ef87
-
SHA512
d7f561fe200c2d1ded74993e9026ad3e6bd93b417ce2d5493690af98f73a632fdf9972a2c3a384d179359934a23047db057b7ae950d293b456b5f53a7b81368f
-
SSDEEP
1536:N7yC8mWxDKt8jEhnjUJGuFHyGquz2ZQ8JYjWJjsPOkDd:N7yGtKEhnj4GEpqBNJ0PZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 93ebc69b8da5a0d814b8b83700d87f80_JaffaCakes118
Files
-
93ebc69b8da5a0d814b8b83700d87f80_JaffaCakes118.exe windows:5 windows x86 arch:x86
28fb2b4b110b8174df159ddacda96c2b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
activeds
DllCanUnloadNow
ConvertSecurityDescriptorToSecDes
ADsBuildEnumerator
AllocADsMem
AllocADsStr
ADsEnumerateNext
AdsTypeToPropVariant
ADsBuildVarArrayStr
ADsEncodeBinaryData
AdsTypeToPropVariant2
ADsBuildVarArrayInt
FreeADsStr
BinarySDToSecurityDescriptor
ADsDecodeBinaryData
PropVariantToAdsType
ConvertSecDescriptorToVariant
ADsGetLastError
ADsOpenObject
ADsFreeEnumerator
ReallocADsStr
DllGetClassObject
ADsSetLastError
FreeADsMem
ADsGetObject
SecurityDescriptorToBinarySD
msvcp60
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@ABV01@@Z
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z
?_Isnan@?$_Ctr@O@std@@SA_NO@Z
?log10@std@@YA?AV?$complex@N@1@ABV21@@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?polar@std@@YA?AV?$complex@O@1@ABO@Z
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGH@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?round_error@?$numeric_limits@K@std@@SAKXZ
?do_pos_format@?$_Mpunct@G@std@@MBE?AUpattern@money_base@2@XZ
?seekoff@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@H@2@JW4seekdir@ios_base@2@H@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?_Cltab@?$ctype@D@std@@0PBFB
?_Fabs@std@@YAOABV?$complex@O@1@PAH@Z
?denorm_min@?$numeric_limits@O@std@@SAOXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
??Dstd@@YA?AV?$complex@N@0@ABV10@0@Z
??1strstreambuf@std@@UAE@XZ
?arg@std@@YANABV?$complex@N@1@@Z
?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEAAV12@ABV12@@Z
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
?id@?$messages@G@std@@2V0locale@2@A
_Mbrtowc
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z
?tellg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@XZ
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAE@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@N@0@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?_Doraise@underflow_error@std@@MBEXXZ
?scan_not@?$ctype@D@std@@QBEPBDFPBD0@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??8std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??4_Num_base@std@@QAEAAU01@ABU01@@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PAG0ABV12@@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
??_Fbad_exception@std@@QAEXXZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0PBDI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
??9locale@std@@QBE_NABV01@@Z
??_F?$moneypunct@G$00@std@@QAEXXZ
?open@?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEXPBDF@Z
??4_Lockit@std@@QAEAAV01@ABV01@@Z
?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??0runtime_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
dhcpcsvc
DhcpRemoveDNSRegistrations
DhcpCApiInitialize
McastReleaseAddress
DhcpEnumClasses
DhcpFallbackRefreshParams
DhcpCApiCleanup
DhcpHandlePnPEvent
DhcpRegisterParamChange
DhcpDeRegisterOptions
DhcpRequestOptions
DhcpAcquireParameters
McastApiStartup
DhcpLeaseIpAddress
DhcpStaticRefreshParams
DhcpRenewIpAddressLeaseEx
DhcpRegisterOptions
McastRenewAddress
DhcpNotifyConfigChangeEx
DhcpOpenGlobalEvent
DhcpAcquireParametersByBroadcast
DhcpDelPersistentRequestParams
DhcpPersistentRequestParams
McastApiCleanup
DhcpReleaseIpAddressLease
DhcpRenewIpAddressLease
DhcpUndoRequestParams
query
?SetValue@CPropertyRestriction@@QAEXPAG@Z
?ciIsValidPointer@@YGHPBX@Z
??0CSortSet@@QAE@I@Z
?Release@CDbProperties@@UAGKXZ
??0CCategorizationSet@@QAE@ABV0@@Z
?GetVPathSSLAccess@CMetaDataMgr@@QAEKPBG@Z
?GetUShort@CMemDeSerStream@@UAEGXZ
?Find@CEmptyPropertyList@@QAEPBVCPropEntry@@ABVCDbColId@@@Z
?TreeCount@CRestriction@@QBEKXZ
??0CAllocStorageVariant@@QAE@AAVPDeSerStream@@AAVPMemoryAllocator@@@Z
?SetColumn@CCatState@@QAEXPBGI@Z
??0CCatState@@QAE@XZ
?LongInit@CPropStoreManager@@QAEXAAHAAKP6GXKHPBX@Z2@Z
?UnMarshall@CDbNumeric@@QAEHAAVPDeSerStream@@@Z
??0CEventItem@@QAE@GGKGKPBX@Z
??1CPidLookupTable@@QAE@XZ
??1CDynStream@@QAE@XZ
?AcqLine@CQueryScanner@@QAEPAGH@Z
?MakeMetadataICommand@@YGJPAPAUIUnknown@@W4CiMetaData@@PBG2PAU1@@Z
_LoadBHIFilter@16
?ReBuild@CPidRemapper@@QAEXABVCPidMapper@@@Z
??0CDbSelectNode@@QAE@XZ
?GetVPathAccess@CMetaDataMgr@@QAEKPBG@Z
?Marshall@CDbParameter@@QBEXAAVPSerStream@@@Z
??0CDriveInfo@@QAE@PBGK@Z
?_FindOrAddValueNode@CDbPropertyRestriction@@AAEPAVCDbScalarValue@@XZ
CollectFILTERPerformanceData
odbccu32
SQLPutData
SQLBindParameter
SQLFreeStmt
SQLSetScrollOptions
SQLCloseCursor
SQLFreeHandle
SQLSetStmtAttr
SQLBulkOperations
SQLFetch
SQLParamData
ReleaseCLStmtResources
SQLSetPos
SQLSetDescRec
SQLGetStmtOption
SQLExtendedFetch
SQLBindCol
SQLGetStmtAttr
SQLExecute
SQLCancel
SQLSetDescField
SQLRowCount
SQLGetInfo
SQLGetData
SQLGetDescField
ole32
HMETAFILE_UserUnmarshal
HBITMAP_UserUnmarshal
CoUnloadingWOW
CoFreeAllLibraries
HACCEL_UserUnmarshal
CoQueryReleaseObject
OleDuplicateData
HMENU_UserUnmarshal
CoMarshalInterface
CLIPFORMAT_UserFree
OleBuildVersion
CLSIDFromProgID
CoSetProxyBlanket
SNB_UserMarshal
OleSetMenuDescriptor
CoGetClassVersion
CoCreateObjectInContext
OleGetIconOfFile
CoSetCancelObject
UpdateDCOMSettings
CreateOleAdviseHolder
StgOpenStorage
CoGetClassObject
StgGetIFillLockBytesOnFile
OleCreateMenuDescriptor
StgGetIFillLockBytesOnILockBytes
StgCreatePropStg
StgCreateDocfile
HDC_UserUnmarshal
OleQueryLinkFromData
kernel32
GetProcessIoCounters
OpenMutexA
CreateMailslotW
UnhandledExceptionFilter
GetNamedPipeHandleStateA
FlushConsoleInputBuffer
GetCommandLineW
DeleteFileW
DuplicateConsoleHandle
SetFilePointer
OutputDebugStringA
BaseInitAppcompatCacheSupport
HeapCreate
CreateJobSet
CallNamedPipeW
InterlockedExchange
EnumLanguageGroupLocalesW
GetUserDefaultUILanguage
VirtualAlloc
VerifyVersionInfoA
LoadLibraryA
FindFirstVolumeA
GetSystemWindowsDirectoryW
OpenEventW
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ