Static task
static1
Behavioral task
behavioral1
Sample
b035c7d0a89a079e325688147ccdc5f7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b035c7d0a89a079e325688147ccdc5f7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b035c7d0a89a079e325688147ccdc5f7_JaffaCakes118
-
Size
31KB
-
MD5
b035c7d0a89a079e325688147ccdc5f7
-
SHA1
7f20d93eac2d2feb4bf27927809dc41c3000b461
-
SHA256
e68f8db4aab9d777267f849b5e6a4386cb531334032ca11a64068a75a3f8cc58
-
SHA512
175268598932028626a289fa4b2dd64825b2bdde39336cddc04a83c9415d09ccd87bdf642293abb49c96938ca3fb98d7fb4dd60295a6186eeb0737e63da93446
-
SSDEEP
768:tnxhn/l8UpcyhiljtB7Xe7JkDDJLXfUIl:tnxhnNGyhojTTgJWDJDMIl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b035c7d0a89a079e325688147ccdc5f7_JaffaCakes118
Files
-
b035c7d0a89a079e325688147ccdc5f7_JaffaCakes118.exe windows:5 windows x86 arch:x86
5891f1c82acd58807bdf472367d73608
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp60
?denorm_min@?$numeric_limits@K@std@@SAKXZ
?pbackfail@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@O@0@@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??4?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
??_7?$moneypunct@D$00@std@@6B@
??_Ftime_base@std@@QAEXXZ
??4Init@ios_base@std@@QAEAAV012@ABV012@@Z
?cos@std@@YA?AV?$complex@O@1@ABV21@@Z
?scan_not@?$ctype@G@std@@QBEPBGFPBG0@Z
?_Psum@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPADPADI@Z
?_Xlen@std@@YAXXZ
?freeze@strstreambuf@std@@QAEX_N@Z
??Kstd@@YA?AV?$complex@M@0@ABV10@0@Z
?_Getctype@_Locinfo@std@@QBE?AU_Ctypevec@@XZ
?pow@std@@YA?AV?$complex@M@1@ABV21@ABM@Z
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAG@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Getmonths@_Locinfo@std@@QBEPBDXZ
_Sinh
?norm@std@@YAOABV?$complex@O@1@@Z
?_Doraise@length_error@std@@MBEXXZ
_LSinh
??8std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??4out_of_range@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z
??Hstd@@YA?AV?$complex@M@0@ABV10@ABM@Z
?_Sinh@?$_Ctr@O@std@@SAOOO@Z
??0?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$complex@O@std@@QAE@ABV?$complex@M@1@@Z
??0?$moneypunct@D$00@std@@QAE@I@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
_Poly
??0?$complex@M@std@@QAE@ABV?$complex@O@1@@Z
?table_size@?$ctype@D@std@@2IB
?ends@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@AAV21@@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPAGII@Z
?sungetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
kernel32
MultiByteToWideChar
QueryDosDeviceA
FatalAppExitW
lstrcpynA
WTSGetActiveConsoleSessionId
RtlCaptureStackBackTrace
FindNextVolumeW
GetOEMCP
MoveFileExW
WriteProfileSectionW
BackupWrite
RtlFillMemory
FindVolumeMountPointClose
OpenEventA
RegisterWaitForSingleObject
AreFileApisANSI
WriteProcessMemory
GetConsoleAliasesLengthW
RemoveDirectoryW
LockFile
GetProcessTimes
LZCloseFile
FindFirstVolumeMountPointA
LZInit
BeginUpdateResourceW
ExitProcess
SetConsoleMenuClose
GetWindowsDirectoryW
AddVectoredExceptionHandler
FindNextVolumeA
LeaveCriticalSection
TlsGetValue
IsSystemResumeAutomatic
GetVersion
Beep
GetEnvironmentStringsW
VirtualProtectEx
GetLargestConsoleWindowSize
GetFirmwareEnvironmentVariableA
CreateWaitableTimerA
GetProfileStringW
GetConsoleAliasExesA
CreateHardLinkW
GetStartupInfoW
EnumDateFormatsW
SearchPathA
SetHandleInformation
VirtualAlloc
VirtualUnlock
UnmapViewOfFile
WaitForSingleObject
DefineDosDeviceW
GetPrivateProfileSectionW
BindIoCompletionCallback
DeleteTimerQueue
VerifyConsoleIoHandle
BuildCommDCBAndTimeoutsA
GetGeoInfoA
GetVolumePathNameA
LoadModule
RegisterWaitForSingleObjectEx
SetTimeZoneInformation
ExpandEnvironmentStringsW
GetHandleContext
GetConsoleAliasExesLengthW
GetCalendarInfoA
Sleep
SetConsoleCursor
GetSystemWow64DirectoryW
GlobalFix
MoveFileA
VerLanguageNameW
RequestDeviceWakeup
opengl32
glPixelStorei
glGenTextures
wglSwapLayerBuffers
glLightModelf
glInitNames
glRasterPos4dv
wglCreateContext
glMaterialf
glTexCoord4f
glGetPixelMapfv
glTexSubImage1D
glRasterPos4sv
glArrayElement
glDrawArrays
wglRealizeLayerPalette
glPixelTransferi
glVertex4dv
glTexCoord1d
glPolygonMode
glNormal3d
glClearStencil
glVertex2i
glTexCoord1dv
wglUseFontOutlinesW
glVertex3iv
glGetTexGendv
glVertex3sv
glBlendFunc
ulib
?Resize@HMEM@@QAEEKK@Z
?ConvertToLocal@TIMEINFO@@QAEEXZ
??0BDSTRING@@QAE@XZ
?QueryWCExpansion@PATH@@QAEPAV1@PAV1@@Z
?PutSeparators@ARGUMENT_LEXEMIZER@@QAEXPBD@Z
?ReplaceWithChars@WSTRING@@QAEEKKGK@Z
?Initialize@PATH@@QAEEPBV1@E@Z
??1DSTRING@@UAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
?InsertString@WSTRING@@QAEEKPBV1@KK@Z
?Strchr@BSTRING@@QBEKDK@Z
?DisplaySystemError@SYSTEM@@SGXKH@Z
?Compare@OBJECT@@UBEJPBV1@@Z
?QueryWindowsErrorMessage@SYSTEM@@SGEKPAVWSTRING@@@Z
?SetBit@BITVECTOR@@QAEXKK@Z
?Construct@DSTRING@@AAEXXZ
?IsYesResponse@MESSAGE@@UAEEE@Z
?GetNext@FSN_DIRECTORY@@QAEPAVFSNODE@@PAPAXPAK@Z
??9WSTRING@@QBEEABV0@@Z
??0CONT_MEM@@QAE@XZ
?SetAllowSwitchGlomming@ARGUMENT_LEXEMIZER@@QAEXE@Z
?Strcmp@WSTRING@@QBEJPBV1@KKKK@Z
?SetAnsiConversions@WSTRING@@SGXXZ
ole32
CLIPFORMAT_UserUnmarshal
OpenOrCreateStream
CoPushServiceDomain
OleIsCurrentClipboard
CoTaskMemAlloc
CoGetDefaultContext
CoGetCallerTID
WriteOleStg
IsEqualGUID
OleQueryLinkFromData
OleSave
CoInitializeWOW
CoMarshalInterface
OleInitialize
ComPs_NdrDllGetClassObject
OleCreateLinkFromData
WriteStringStream
HENHMETAFILE_UserMarshal
OleGetAutoConvert
WdtpInterfacePointer_UserUnmarshal
CoGetMalloc
CoRevertToSelf
CoGetInterceptorFromTypeInfo
CreateOleAdviseHolder
mprddm
DDMAdminPortReset
DDMGetIdentityAttributes
RasAcctProviderTerminate
DDMAdminPortGetInfo
DDMAdminPortEnum
RasAcctProviderStartAccounting
RasAuthProviderFreeAttributes
DDMAdminServerGetInfo
RasAcctProviderFreeAttributes
DDMSendUserMessage
DDMAdminConnectionEnum
RasAuthProviderTerminate
RasAcctProviderInitialize
DDMServicePostListens
DDMAdminConnectionGetInfo
DDMServiceInitialize
DDMAdminInterfaceDisconnect
RasAuthProviderInitialize
RasAuthProviderAuthenticateUser
DDMAdminPortDisconnect
RasAuthConfigChangeNotification
IfObjectLoadPhonebookInfo
IfObjectInitiatePersistentConnections
IfObjectNotifyOfReachabilityChange
msvcrt40
_adj_fdivr_m32
??0logic_error@@QAE@ABQBD@Z
wcsncat
_getcwd
_tolower
_daylight
?get@istream@@QAEAAV1@PADHD@Z
??_Dostrstream@@QAEXXZ
??_Gifstream@@UAEPAXI@Z
??0logic_error@@QAE@ABV0@@Z
strtok
strncat
??_8ifstream@@7B@
_ismbcpunct
??0ostrstream@@QAE@ABV0@@Z
_mtunlock
_cscanf
__set_app_type
?read@istream@@QAEAAV1@PACH@Z
?setp@streambuf@@IAEXPAD0@Z
islower
isleadbyte
rename
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?setbuf@ifstream@@QAEPAVstreambuf@@PADH@Z
_spawnlp
?str@istrstream@@QAEPADXZ
??0bad_cast@@QAE@ABV0@@Z
_wcsnset
_wfsopen
_getch
_strnset
?binary@filebuf@@2HB
rasman
RasDeviceGetInfo
RasPortGetStatisticsEx
RasGetNumPortOpen
RasRpcPortEnum
RasCompressionSetInfo
IsRasmanProcess
RasEnumConnectionPorts
RasSecurityDialogGetInfo
RasRpcGetDevConfig
RasGetInfo
RasRpcDeleteEntry
RasRpcRemoteRasDeleteEntry
RasRpcRemoteGetUserPreferences
RasSetConnectionParams
RasAllocateRoute
RasGetHportFromConnection
RasGetConnectionUserData
RasPortEnum
RasRpcGetInstalledProtocols
RasConnectionEnum
RasRpcGetSystemDirectory
RasSetKey
RasCreateConnection
RasRpcConnect
RasLinkGetStatistics
rasser
PortGetStatistics
PortSetInfo
PortDisconnect
PortEnum
PortInit
PortChangeCallback
PortGetInfo
PortCompressionSetInfo
PortConnect
PortSetINetCfg
PortSend
PortReceive
PortOpen
PortTestSignalState
PortGetPortState
PortClose
PortSetFraming
PortReceiveComplete
PortClearStatistics
dmdskmgr
?IsNEC_98Server@CTaskData@@QAEHXZ
?GetAssignedDriveLetter@CTaskData@@QAEHJAAG@Z
?RecalculateSpace@CDMNodeObj@@QAEXXZ
?GetImageNum@CDMNodeObj@@QAEHXZ
?IsSecureSystemPartition@CTaskData@@QAEHXZ
?EnumFirstVolumeMember@CDMNodeObj@@QAEXAAJ0@Z
?namecmp@@YGHPBG0@Z
?GetPartitionStyle@CDMNodeObj@@QAE?AW4_PARTITIONSTYLE@@XZ
?ConvertMBToBytes@@YG_J_J@Z
?IsWolfpack@CTaskData@@QAEHXZ
?GetObjectId@CDMNodeObj@@QAEXAA_J@Z
?CanHaveGPT@CDMNodeObj@@QAEHXZ
?GetDriveLetter@CDMNodeObj@@QAEXAAG@Z
?ContainsSystemInformation@CDMNodeObj@@QAEHXZ
?ContainsBootIniPartitionForWolfpack@CDMNodeObj@@QAEHXZ
?SetFSId@CDMNodeObj@@QAEX_J@Z
?GetParentVolumePtr@CDMNodeObj@@QAEPAV1@XZ
?VolumeContainsActiveRegion@CDMNodeObj@@QAEHXZ
DllGetClassObject
?ContainsSystemPartition@CDMNodeObj@@QAEHXZ
?GetColorRef@CDMNodeObj@@QAEKXZ
?GetDiskCookiesToEncap@CTaskData@@QAEXAAKPAPAJ@Z
?GetStorageType@CDMNodeObj@@QAE?AW4_STORAGE_TYPES@@XZ
?GetDeviceType@CDMNodeObj@@QAEKXZ
IsRequestPending
?FindFileSystem@CTaskData@@QAEH_JAAUfilesysteminfo@@@Z
?ContainsRealSystemPartition@CDMNodeObj@@QAEHXZ
?EnumNTFSwithDriveLetter@CDataCache@@QAEXPAHPAPAG@Z
?IsOemPartition@CDMNodeObj@@QAEHXZ
?HasNTFSwithDriveLetter@CDataCache@@QAEHXZ
?GetDeviceState@CDMNodeObj@@QAEKXZ
msvcrt
_y0
wcstol
_putw
_wfindfirst64
_snscanf
cos
_mbsrev
_vscwprintf
_purecall
_aligned_offset_malloc
_fputwchar
_beginthread
_amsg_exit
??_Fbad_cast@@QAEXXZ
_adj_fdivr_m64
_wctime64
_ismbcpunct
floor
_isnan
exp
_environ
ldiv
_utime64
system
_mkdir
_cexit
strftime
feof
shell32
SHGetMalloc
user32
EndDialog
PostMessageA
MessageBoxA
dfsshlex
DllRegisterServer
DllUnregisterServer
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE