Static task
static1
Behavioral task
behavioral1
Sample
aca7cede89676cd17d56e5aefdc00c08_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
aca7cede89676cd17d56e5aefdc00c08_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
aca7cede89676cd17d56e5aefdc00c08_JaffaCakes118
-
Size
157KB
-
MD5
aca7cede89676cd17d56e5aefdc00c08
-
SHA1
cba3968a2f910dacc855913c9725b536ecf6bfc2
-
SHA256
feeae2d42c8736250da3d462d7bdbe191710addf771aefc69018f11bb285ba4c
-
SHA512
dd67ff6c80a1db77ecd2093ae2dae0824f30cf3189c54eb281c327bebc4c836be75c10d12cb10353dacbfbc9cf01757f546dc8dbdd37ee25af3679d47260072d
-
SSDEEP
3072:qHYFd84vJoQp/PjG49/yQqef4qXDRvXoA6+wzgGP402AJsQ3acnP:qb4vSQpnbyQuwRwAjw5P2Q3a
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aca7cede89676cd17d56e5aefdc00c08_JaffaCakes118
Files
-
aca7cede89676cd17d56e5aefdc00c08_JaffaCakes118.exe windows:5 windows x86 arch:x86
e47657be482249db1252f40a9dfcf275
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp60
?is@?$ctype@D@std@@QBEPBDPBD0PAF@Z
??0money_base@std@@QAE@I@Z
??0_Locinfo@std@@QAE@ABV01@@Z
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?exp@?$_Ctr@O@std@@SAOO@Z
??0?$codecvt@GDH@std@@QAE@ABV_Locinfo@1@I@Z
??4?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0bad_exception@std@@QAE@ABV01@@Z
??0?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAF@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?cosh@std@@YA?AV?$complex@M@1@ABV21@@Z
?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
?_Init@?$ctype@D@std@@IAEXABV_Locinfo@2@@Z
?__Fiopen@std@@YAPAU_iobuf@@PBDH@Z
??0bad_cast@std@@QAE@PBD@Z
??9std@@YA_NABV?$complex@N@0@0@Z
?length@?$char_traits@G@std@@SAIPBG@Z
??0?$complex@N@std@@QAE@ABV?$complex@O@1@@Z
?id@?$messages@D@std@@2V0locale@2@A
wcsrtombs
?denorm_min@?$numeric_limits@_N@std@@SA_NXZ
?ldexp@?$_Ctr@O@std@@SAOOH@Z
?quiet_NaN@?$numeric_limits@E@std@@SAEXZ
??4?$numeric_limits@F@std@@QAEAAV01@ABV01@@Z
?signaling_NaN@?$numeric_limits@M@std@@SAMXZ
?osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBD@Z
?do_tolower@?$ctype@G@std@@MBEGG@Z
?pbackfail@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@MAEHH@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@
??1bad_cast@std@@UAE@XZ
??_Fbad_typeid@std@@QAEXXZ
?positive_sign@?$_Mpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?_Psum@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGPBGI@Z
?quiet_NaN@?$numeric_limits@_N@std@@SA_NXZ
??0?$collate@D@std@@QAE@I@Z
??4?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_8?$basic_fstream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@
?conj@std@@YA?AV?$complex@O@1@ABV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?close@?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?_Cosh@?$_Ctr@M@std@@SAMMM@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?swap@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXAAV12@@Z
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?toupper@?$ctype@D@std@@QBEDD@Z
?negative_sign@?$_Mpunct@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PBDH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z
?do_tolower@?$ctype@G@std@@MBEPBGPAGPBG@Z
??0locale@std@@QAE@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??_7?$basic_fstream@GU?$char_traits@G@std@@@std@@6B@
??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$numpunct@D@std@@QAE@ABV_Locinfo@1@I@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?id@?$moneypunct@D$00@std@@2V0locale@2@A
??4?$numeric_limits@O@std@@QAEAAV01@ABV01@@Z
??_7messages_base@std@@6B@
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@
?round_error@?$numeric_limits@D@std@@SADXZ
??Hstd@@YA?AV?$complex@N@0@ABV10@@Z
?thousands_sep@?$numpunct@D@std@@QBEDXZ
??4bad_exception@std@@QAEAAV01@ABV01@@Z
?sungetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?seekoff@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@JW4seekdir@ios_base@2@H@Z
kernel32
CreateThread
RegisterConsoleVDM
GetCompressedFileSizeA
FreeLibraryAndExitThread
SetConsoleScreenBufferSize
LockResource
Thread32Next
ReadConsoleInputExW
GetConsoleFontInfo
FindNextVolumeMountPointW
ReadFile
GetCommandLineA
LoadLibraryA
CreateTimerQueue
GetConsoleCommandHistoryA
GlobalAddAtomW
VirtualAlloc
SetConsoleActiveScreenBuffer
UpdateResourceA
EnumerateLocalComputerNamesA
SetFileValidData
EnterCriticalSection
GetConsoleOutputCP
SetVolumeLabelA
GetStringTypeExA
LeaveCriticalSection
CompareStringW
BeginUpdateResourceW
GetPrivateProfileSectionA
ReadFileEx
DeleteCriticalSection
SetWaitableTimer
DelayLoadFailureHook
CommConfigDialogA
FindResourceA
HeapSize
mfcsubs
??4CString@@QAEABV0@D@Z
?Lock@CCriticalSection@@UAEHK@Z
?SafeStrlen@CString@@KGHPBG@Z
??N@YG_NPBGABVCString@@@Z
?SpanExcluding@CString@@QBE?AV1@PBG@Z
??O@YG_NABVCString@@0@Z
?Release@CString@@IAEXXZ
??YCString@@QAEABV0@ABV0@@Z
?RemoveAll@CMapStringToPtr@@QAEXXZ
??0CMapStringToPtr@@QAE@H@Z
??H@YG?AVCString@@ABV0@G@Z
?AfxA2WHelper@@YGPAGPAGPBDH@Z
??YCString@@QAEABV0@G@Z
??BCString@@QBEPBGXZ
?AllocBuffer@CString@@IAEXH@Z
??0CString@@QAE@XZ
??_7CStringArray@@6B@
?Find@CString@@QBEHPBG@Z
??0CString@@QAE@GH@Z
?GetBufferSetLength@CString@@QAEPAGH@Z
??H@YG?AVCString@@GABV0@@Z
?AfxW2AHelper@@YGPADPADPBGH@Z
?AfxLoadString@@YGHIPAGI@Z
?MakeUpper@CString@@QAEXXZ
?LockBuffer@CString@@QAEPAGXZ
?Lookup@CMapStringToPtr@@QBEHPBGAAPAX@Z
??_7CObject@@6B@
?Mid@CString@@QBE?AV1@HH@Z
?FreeExtra@CStringArray@@QAEXXZ
??0CString@@QAE@PBE@Z
??ACString@@QBEGH@Z
?FreeExtra@CString@@QAEXXZ
?Unlock@CSyncObject@@UAEHJPAJ@Z
wship6
WSHIoctl
WSHGetSocketInformation
WSHGetSockaddrType
WSHEnumProtocols
WSHStringToAddress
WSHGetWSAProtocolInfo
WSHNotify
WSHGetWildcardSockaddr
WSHGetProviderGuid
WSHOpenSocket2
WSHGetWinsockMapping
WSHSetSocketInformation
WSHJoinLeaf
WSHOpenSocket
WSHAddressToString
clusapi
PauseClusterNode
ClusterRegEnumKey
ClusterEnum
ClusterResourceTypeOpenEnum
EvictClusterNodeEx
ClusterGroupEnum
ClusterRegDeleteKey
ClusterNodeControl
GetClusterFromNode
RestoreClusterDatabase
GetClusterFromNetwork
GetClusterFromResource
AddClusterResourceNode
GetClusterInformation
SetClusterResourceName
OpenClusterNetInterface
ClusterNodeGetEnumCount
CreateClusterNotifyPort
ClusterRegOpenKey
OfflineClusterResource
RemoveClusterResourceDependency
ClusterResourceEnum
SetClusterNetworkPriorityOrder
GetNodeClusterState
OnlineClusterResource
ClusterGroupGetEnumCount
CloseClusterNetInterface
SetClusterQuorumResource
ChangeClusterResourceGroup
CreateClusterResourceType
OpenCluster
GetClusterNetworkKey
SetClusterNetworkName
GetClusterResourceNetworkName
ClusterGroupControl
ClusterNetworkGetEnumCount
DeleteClusterResource
GetClusterKey
CloseClusterNode
crypt32
CryptHashPublicKeyInfo
I_CryptInsertLruEntry
RegCreateHKCUKeyExU
PFXVerifyPassword
CryptExportPKCS8
CertRemoveStoreFromCollection
CertFindSubjectInSortedCTL
CryptVerifyCertificateSignature
CertEnumCTLContextProperties
CertGetCTLContextProperty
I_CryptRemoveLruEntry
I_CryptFindLruEntry
CryptHashMessage
CryptMsgSignCTL
CryptMemAlloc
CryptVerifyDetachedMessageHash
I_CryptUninstallAsn1Module
CertFindCTLInStore
CertEnumPhysicalStore
CertRegisterPhysicalStore
CryptMsgCountersignEncoded
CertEnumCertificatesInStore
CertDuplicateCTLContext
I_CryptGetLruEntryIdentifier
CryptMsgCountersign
msvcrt
exit
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 62KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ