Static task
static1
Behavioral task
behavioral1
Sample
ba3f57499cba29a397fe3eabf5e4e4d5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ba3f57499cba29a397fe3eabf5e4e4d5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ba3f57499cba29a397fe3eabf5e4e4d5_JaffaCakes118
-
Size
149KB
-
MD5
ba3f57499cba29a397fe3eabf5e4e4d5
-
SHA1
a0020cc863aa6285d51c29d912b3893a07e91fa4
-
SHA256
5d20bf97685c500af8019b07bfe2545b4a57bdb4f543317d30dbec516ab49d86
-
SHA512
7f49c587e3f8d91e8e899d116d7b9b8339b3b820ea14775311c3adcfc3f30b5b91fdf13e9f165d9fc1b65384c6e57eb7b493c19caa74feff54e70e5f6d5e69b1
-
SSDEEP
3072:wwpOJF9hnSSl+uq2Ie+/zRZ7ZSPyzE9478bE9ij:w2Unzl+ua/zRZN6yr7Sr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba3f57499cba29a397fe3eabf5e4e4d5_JaffaCakes118
Files
-
ba3f57499cba29a397fe3eabf5e4e4d5_JaffaCakes118.exe windows:5 windows x86 arch:x86
77ca4db2215a55ff79b44c1830ccf528
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp60
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@XZ
?quiet_NaN@?$numeric_limits@M@std@@SAMXZ
?data@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?_Sinh@?$_Ctr@N@std@@SANNN@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$complex@O@0@@Z
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?pubsetbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PADH@Z
??_F?$moneypunct@D$00@std@@QAEXXZ
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?thousands_sep@?$_Mpunct@G@std@@QBEGXZ
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGHG@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z
?do_thousands_sep@?$numpunct@D@std@@MBEDXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?widen@?$ctype@G@std@@QBEGD@Z
??_7?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@6B@
??_7?$basic_ios@GU?$char_traits@G@std@@@std@@6B@
?ldexp@?$_Ctr@N@std@@SANNH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@JW4seekdir@ios_base@2@H@Z
??_F?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_7?$moneypunct@G$0A@@std@@6B@
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Getcat@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIXZ
?denorm_min@?$numeric_limits@H@std@@SAHXZ
??1?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
_LRteps
crypt32
CryptMsgVerifyCountersignatureEncoded
CryptFindCertificateKeyProvInfo
CryptStringToBinaryA
CertFindSubjectInSortedCTL
CryptSIPGetSignedDataMsg
CryptMsgGetParam
CryptEncryptMessage
CertVerifySubjectCertificateContext
CertGetCertificateContextProperty
CryptMsgCountersignEncoded
CertCreateCertificateContext
CryptCreateAsyncHandle
CryptQueryObject
I_CertSyncStore
I_CryptUninstallOssGlobal
CryptSIPRemoveProvider
CryptMsgControl
CryptGetMessageSignerCount
CertGetSubjectCertificateFromStore
CertAddCTLContextToStore
CertDuplicateCertificateContext
CertAddEnhancedKeyUsageIdentifier
CertFindCTLInStore
CertEnumCRLsInStore
CertFindChainInStore
CertSetCertificateContextProperty
CryptSIPRemoveSignedDataMsg
CryptVerifyMessageSignature
RegOpenKeyExU
CryptMsgEncodeAndSignCTL
CryptEnumOIDFunction
CryptGetOIDFunctionValue
CryptBinaryToStringA
sqlunirl
_EnumWindowStations_@8
_LoadMenu@8
_GetServiceKeyName_@16
_SetCurrentDirectory_@4
_EnumDesktops_@12
_StartDoc@8
_GetDiskFreeSpaceEx_@16
_OemToChar_@8
_IsCharLower_@4
_OpenBackupEventLog_@8
_DefFrameProc_@20
_AddAtom_@4
_RegQueryValueEx_@24
_GetLocaleInfo_@16
_NDdeShareSetInfo_@24
_FindResourceEx_@16
_FindText_@4
_OpenMutex_@12
_CreateEvent_@16
_CallMsgFilter_@8
_DlgDirSelectEx_@16
_RegEnumKeyEx_@32
_InsertMenu_@20
_CreateDirectory_@8
_GetClassInfoEx_@12
_CreateColorSpace_@4
__lopen_@8
_FindNextFile_@8
_NDdeShareDel_@12
_PropertySheet_@4
_lstrcat_@8
_RemoveDirectory_@4
_GlobalAddAtom_@4
_GetTimeFormat_@24
_DlgDirListComboBox_@20
_LookupAccountSid_@28
_PrintDlg_@4
lz32
LZDone
LZCloseFile
GetExpandedNameA
LZOpenFileA
LZRead
LZInit
LZStart
LZSeek
LZClose
LZOpenFileW
CopyLZFile
LZCopy
kernel32
WaitCommEvent
VirtualAlloc
TransactNamedPipe
GetConsoleCharType
WriteConsoleOutputCharacterW
FlushConsoleInputBuffer
GetQueuedCompletionStatus
SetDefaultCommConfigW
SetFirmwareEnvironmentVariableW
SetLocalTime
_lwrite
CreateSemaphoreW
IsDebuggerPresent
DeleteVolumeMountPointW
GetLogicalDriveStringsW
GetTapeStatus
FatalAppExitA
GlobalAddAtomW
SetTermsrvAppInstallMode
BaseDumpAppcompatCache
SetCurrentDirectoryA
GetWindowsDirectoryW
CreateJobObjectW
TlsAlloc
CreateFileMappingW
LZInit
ReadFileScatter
GetSystemDefaultLCID
FindFirstFileExW
ReadConsoleOutputA
VirtualAllocEx
TerminateJobObject
lstrlenW
FreeUserPhysicalPages
PeekNamedPipe
SetHandleInformation
PrivMoveFileIdentityW
GetStringTypeA
GetFullPathNameA
GetConsoleFontSize
QueryInformationJobObject
SetConsoleHardwareState
EnterCriticalSection
LoadLibraryA
Thread32Next
IsValidCodePage
GetUserDefaultLCID
LeaveCriticalSection
CreateToolhelp32Snapshot
TermsrvAppInstallMode
GetConsoleAliasExesA
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ