Static task
static1
Behavioral task
behavioral1
Sample
b3c2b898171a5a909a079ef1efe9ba2d_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b3c2b898171a5a909a079ef1efe9ba2d_JaffaCakes118
-
Size
833KB
-
MD5
b3c2b898171a5a909a079ef1efe9ba2d
-
SHA1
bde86f68c4f1eb03eb989f479231fe0438aa7fd4
-
SHA256
9e9f86514d100d4b14b9b4f005b6c41355369f873cfd70c2cd4dbd736016f12f
-
SHA512
68ef1e0ef6ad372f340577d02ad8a72a43c5049ee18a51cb7ade9c28727c25eb3d3ba4fcebed977f366fcfaefb1ee15c563f370de892be6ed15dd3b5944f3199
-
SSDEEP
24576:mGm23TP9mCbZfMGaD/EbM/i267uO68e9hHNZCO:jIlGW/En267spHC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b3c2b898171a5a909a079ef1efe9ba2d_JaffaCakes118
Files
-
b3c2b898171a5a909a079ef1efe9ba2d_JaffaCakes118.exe windows:5 windows x86 arch:x86
3f02370fc11cf503d83113ccbb616e4f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp60
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@N@0@@Z
?_Cosh@?$_Ctr@O@std@@SAOOO@Z
??_7out_of_range@std@@6B@
_Hugeval
?flags@ios_base@std@@QAEHH@Z
??4?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
??Hstd@@YA?AV?$complex@N@0@ABV10@0@Z
?do_close@?$messages@G@std@@MBEXH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??_7overflow_error@std@@6B@
?open@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXPBDF@Z
_Dnorm
?_Gettrue@_Locinfo@std@@QBEPBDXZ
??0bad_typeid@std@@QAE@ABV01@@Z
??0?$_Complex_base@O@std@@QAE@ABO0@Z
?imag@?$_Complex_base@O@std@@QAEOABO@Z
??0?$codecvt@GDH@std@@QAE@ABV_Locinfo@1@I@Z
?do_thousands_sep@?$_Mpunct@D@std@@MBEDXZ
?do_in@?$codecvt@DDH@std@@MBEHAAHPBD1AAPBDPAD3AAPAD@Z
??Ostd@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
?_Pdif@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAIPBG0@Z
??_F?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??_7?$basic_ofstream@DU?$char_traits@D@std@@@std@@6B@
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?curr_symbol@?$_Mpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@G@Z
?move@?$char_traits@G@std@@SAPAGPAGPBGI@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PBDH@Z
??0bad_exception@std@@QAE@ABV01@@Z
?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@N@0@@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??_8?$basic_ifstream@GU?$char_traits@G@std@@@std@@7B@
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADPAD0@Z
?widen@?$ctype@D@std@@QBEPBDPBD0PAD@Z
?_Doraise@overflow_error@std@@MBEXXZ
??1ctype_base@std@@UAE@XZ
?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??Dstd@@YA?AV?$complex@M@0@ABV10@0@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??_8?$basic_ostream@DU?$char_traits@D@std@@@std@@7B@
?pbackfail@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@MAEHH@Z
?polar@std@@YA?AV?$complex@M@1@ABM0@Z
?thousands_sep@?$_Mpunct@D@std@@QBEDXZ
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@E@Z
??4?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEAAV01@ABV01@@Z
?id@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
??8std@@YA_NABNABV?$complex@N@0@@Z
??_7?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@M@Z
?_Xran@std@@YAXXZ
?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@V32@H@Z
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ
??_D?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?cosh@std@@YA?AV?$complex@M@1@ABV21@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
_FXbig
??4?$_Ctr@O@std@@QAEAAV01@ABV01@@Z
?length@?$char_traits@G@std@@SAIPBG@Z
??Nstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAN@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@M@0@@Z
?ldexp@?$_Ctr@M@std@@SAMMH@Z
?freeze@strstreambuf@std@@QAEX_N@Z
??0?$ctype@G@std@@QAE@I@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@XZ
msvcrt40
_strdup
_CxxThrowException
_CIpow
towupper
printf
_CIexp
?get@istream@@QAEAAV1@AAC@Z
_inpw
_wgetdcwd
?base@streambuf@@IBEPADXZ
_flsbuf
wcscat
??_8ifstream@@7B@
?tie@ios@@QBEPAVostream@@XZ
log10
??_Dstdiostream@@QAEXXZ
?setbuf@ofstream@@QAEPAVstreambuf@@PADH@Z
_open
??1type_info@@UAE@XZ
??0ifstream@@QAE@HPADH@Z
_open_osfhandle
setvbuf
strncmp
_strdate
isxdigit
_adj_fpatan
_spawnvpe
_cabs
_mbccpy
?setmode@ifstream@@QAEHH@Z
strftime
??2@YAPAXI@Z
_safe_fprem
?clear@ios@@QAEXH@Z
?setg@streambuf@@IAEXPAD00@Z
?ws@@YAAAVistream@@AAV1@@Z
??0filebuf@@QAE@XZ
_fdopen
_tzset
_mbsrev
??4Iostream_init@@QAEAAV0@ABV0@@Z
_stricmp
??_Eostream@@UAEPAXI@Z
_wutime
wcsxfrm
ntdll
KiUserCallbackDispatcher
RtlQueueApcWow64Thread
RtlIsGenericTableEmpty
RtlCopyUnicodeString
ZwVdmControl
RtlUnhandledExceptionFilter2
memmove
NtDeleteKey
RtlAddAce
RtlpNtCreateKey
NtCreateNamedPipeFile
RtlLargeIntegerArithmeticShift
PfxFindPrefix
NtSetEaFile
RtlSubtreeSuccessor
RtlValidSid
NtSetInformationObject
__isascii
RtlSetLastWin32Error
ZwCreateProfile
RtlFindMostSignificantBit
ZwListenPort
ZwSetInformationFile
RtlDeactivateActivationContextUnsafeFast
ZwShutdownSystem
atol
rpcrt4
NdrConvert2
NdrRpcSmSetClientToOsf
RpcMgmtStopServerListening
RpcObjectInqType
NdrRpcSsDefaultFree
I_RpcBindingInqDynamicEndpointA
NdrNonConformantStringUnmarshall
RpcSmAllocate
RpcBindingCopy
NDRSContextUnmarshall2
CStdStubBuffer_Disconnect
I_RpcGetExtendedError
RpcMgmtSetCancelTimeout
NdrNonEncapsulatedUnionUnmarshall
UuidCreateNil
NdrServerInitializePartial
NdrMesTypeAlignSize
NdrAsyncServerCall
RpcMgmtStatsVectorFree
NdrConformantVaryingStructBufferSize
UuidToStringA
NdrConformantVaryingArrayMemorySize
I_RpcServerUseProtseqEp2A
UuidCompare
NdrEncapsulatedUnionBufferSize
NdrConformantStringMemorySize
I_RpcServerSetAddressChangeFn
NdrpMemoryIncrement
IUnknown_QueryInterface_Proxy
I_RpcNsBindingSetEntryNameW
NdrNsGetBuffer
RpcAsyncAbortCall
RpcServerRegisterIf2
RpcIfIdVectorFree
rtm
RtmReleaseEntityInfo
RtmGetFirstRoute
RtmCreateNextHopEnum
RtmCreateRouteList
RtmAddRoute
SearchInTable
DeleteFromTable
RtmGetInstanceInfo
RtmRegisterEntity
RtmWriteInstanceConfig
RtmReadInstanceConfig
RtmGetEntityInfo
EnumOverTable
RtmBlockMethods
NextMatchInTable
RtmDequeueRouteChangeMessage
RtmGetEnumRoutes
RtmReleaseRouteInfo
RtmLockDestination
RtmGetMostSpecificDestination
CheckTable
RtmBlockSetRouteEnable
RtmDeleteNextHop
RtmGetRouteInfo
RtmGetRoutePointer
RtmInsertInRouteList
RtmReleaseDests
RtmLockRoute
RtmReleaseChangedDests
RtmGetNextHopInfo
MgmGetFirstMfe
RtmCloseEnumerationHandle
RtmFindNextHop
RtmUpdateAndUnlockRoute
RtmCreateDestEnum
uxtheme
OpenThemeData
GetThemeRect
GetThemeTextExtent
DrawThemeBackground
GetThemeEnumValue
IsThemePartDefined
GetThemeBool
GetThemeBackgroundRegion
EnableThemeDialogTexture
GetThemeBackgroundContentRect
GetThemeTextMetrics
CloseThemeData
GetThemeString
IsThemeDialogTextureEnabled
GetThemeFont
GetThemeSysString
GetThemeDocumentationProperty
DrawThemeIcon
IsThemeActive
GetThemeBackgroundExtent
GetThemeIntList
GetCurrentThemeName
GetThemePartSize
GetWindowTheme
GetThemeMargins
SetWindowTheme
msvcirt
?seekg@istream@@QAEAAV1@JW4seek_dir@ios@@@Z
?ipfx@istream@@QAEHH@Z
?lockptr@streambuf@@IAEPAU_CRT_CRITICAL_SECTION@@XZ
??_Gstrstreambuf@@UAEPAXI@Z
?in_avail@streambuf@@QBEHXZ
??_Gostrstream@@UAEPAXI@Z
?sh_read@filebuf@@2HB
?seekoff@filebuf@@UAEJJW4seek_dir@ios@@H@Z
??0strstreambuf@@QAE@PADH0@Z
??4stdiobuf@@QAEAAV0@ABV0@@Z
??4ostream_withassign@@QAEAAV0@ABV0@@Z
??0fstream@@QAE@PBDHH@Z
?good@ios@@QBEHXZ
??0ofstream@@QAE@HPADH@Z
?lockptr@ios@@IAEPAU_CRT_CRITICAL_SECTION@@XZ
?fd@ofstream@@QBEHXZ
?setlock@ios@@QAAXXZ
??_8istream_withassign@@7B@
?pbackfail@stdiobuf@@UAEHH@Z
?fd@ifstream@@QBEHXZ
??6ostream@@QAEAAV0@PBE@Z
??_Gstdiobuf@@UAEPAXI@Z
??0ifstream@@QAE@XZ
?out_waiting@streambuf@@QBEHXZ
??0filebuf@@QAE@ABV0@@Z
??_Distrstream@@QAEXXZ
?hex@@YAAAVios@@AAV1@@Z
?read@istream@@QAEAAV1@PAEH@Z
??_7istream_withassign@@6B@
??0logic_error@@QAE@ABV0@@Z
??_Dostrstream@@QAEXXZ
??1ostrstream@@UAE@XZ
??0ifstream@@QAE@HPADH@Z
?open@filebuf@@QAEPAV1@PBDHH@Z
??0stdiostream@@QAE@ABV0@@Z
??4ofstream@@QAEAAV0@ABV0@@Z
??5istream@@QAEAAV0@PAE@Z
kernel32
LZInit
WaitForSingleObject
GetSystemDefaultUILanguage
UTRegister
MoveFileExW
ActivateActCtx
SetNamedPipeHandleState
SetConsoleTextAttribute
SetSystemPowerState
PrepareTape
DosDateTimeToFileTime
InitAtomTable
FoldStringW
LoadLibraryA
VirtualAlloc
GlobalFree
GetNumaProcessorNode
GetSystemDirectoryA
GetFullPathNameW
FindClose
GetCurrencyFormatW
GlobalHandle
GetEnvironmentStringsW
FindActCtxSectionStringA
GetPrivateProfileStructA
ExitVDM
BaseCleanupAppcompatCacheSupport
EnumResourceNamesA
MulDiv
SetConsoleWindowInfo
SetFileShortNameA
UnlockFileEx
EnumCalendarInfoA
LZClose
GetNumberOfConsoleFonts
GetLongPathNameW
EnumCalendarInfoExA
RemoveDirectoryW
msasn1
ASN1BERDecOctetString
ASN1BERDecS32Val
ASN1_FreeDecoded
ASN1CEREncBitString
ASN1BEREncCheck
ASN1CEREncUTCTime
ASN1EncSetError
ASN1_CreateModule
ASN1BEREncNull
ASN1BERDecUTF8String
ASN1_SetDecoderOption
ASN1objectidentifier_free
ASN1objectidentifier_cmp
ASN1BERDecZeroChar32String
ASN1_CloseDecoder
ASN1BEREncFlush
ASN1BEREncDouble
ASN1BERDecU8Val
ASN1BEREncChar16String
ASN1ztchar16string_free
ASN1CEREncOctetString
ASN1BEREncBool
ASN1BERDecNotEndOfContents
ASN1BERDecNull
ASN1charstring_free
ASN1CEREncBeginBlk
ASN1BEREncU32
ASN1BEREncRemoveZeroBits
ASN1BERDecCheck
ASN1BERDecChar32String
ASN1BEREoid2DotVal
ASN1BEREncZeroMultibyteString
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 722KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ