Static task
static1
Behavioral task
behavioral1
Sample
bc376d08a3e1d2749b225d51da33e50e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bc376d08a3e1d2749b225d51da33e50e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bc376d08a3e1d2749b225d51da33e50e_JaffaCakes118
-
Size
65KB
-
MD5
bc376d08a3e1d2749b225d51da33e50e
-
SHA1
8dd118c20e6326507d9b406eb260f23c64261c1d
-
SHA256
1cbf9c28b34bc8ab1262f3adea1b23e3404444f0f5390e127f286d55e3aee966
-
SHA512
1fe97a882c7b6f0203f73033c7cd5936dbc04de79ef5a69895f4f6524990b68b05c1e6968912768e66073eb1d6930cb400b71f761ba3e26c4315090bd64f7d49
-
SSDEEP
1536:pwuAF8gEab+e2Q/i/CbsaaFyN53WJoRODs+GwSEMf:KF8RMd/7JaQnWJoRODs+G5jf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc376d08a3e1d2749b225d51da33e50e_JaffaCakes118
Files
-
bc376d08a3e1d2749b225d51da33e50e_JaffaCakes118.exe .js windows:5 windows x86 arch:x86 polyglot
e1fd5ec28f1549daeef00674eb518e99
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc100
ord6293
ord6671
ord1313
ord300
ord2611
ord1294
ord1316
ord417
ord5827
ord4868
ord4870
ord11646
ord6010
ord2056
ord11274
ord265
ord266
ord13310
ord9475
ord13329
ord918
ord342
ord1483
ord4144
ord306
ord7832
ord2010
ord977
ord13137
ord13131
ord11461
ord2524
ord11277
ord5208
ord10906
ord421
ord12868
ord12962
ord11067
ord8137
ord10007
ord10360
ord2974
ord2973
ord2752
ord5532
ord12531
ord2881
ord2878
ord7349
ord2416
ord14059
ord14061
ord14060
ord14058
ord14062
ord14045
ord13972
ord13973
ord8235
ord2067
ord3395
ord10883
ord8070
ord11107
ord6217
ord9994
ord8351
ord2847
ord12644
ord11190
ord11188
ord1496
ord1503
ord1509
ord1507
ord1514
ord4373
ord4410
ord4381
ord4393
ord4389
ord4385
ord4415
ord4406
ord4377
ord4419
ord4398
ord4364
ord4368
ord4401
ord3991
ord13980
ord3984
ord2661
ord13302
ord7074
ord13300
ord6128
ord10672
ord12482
ord5253
ord2338
ord3484
ord2945
ord2944
ord2846
ord11103
ord5123
ord9286
ord8305
ord5803
ord381
ord1900
ord3390
ord1929
ord8554
ord13294
ord11060
ord310
ord11744
ord7487
ord2063
ord2061
ord6678
ord13303
ord11025
ord12865
ord4283
ord3620
ord1448
ord946
ord901
ord1288
ord7584
ord7510
ord11726
ord13767
ord4724
ord2163
ord11420
ord11421
ord13301
ord7073
ord13299
ord8486
ord3676
ord3618
ord11806
ord7091
ord1732
ord14075
ord10922
ord13181
ord11413
ord7144
ord13483
ord13480
ord13485
ord13482
ord13484
ord13481
ord3409
ord5238
ord11172
ord11180
ord4078
ord7355
ord9449
ord11184
ord11153
ord11787
ord4622
ord4903
ord5095
ord8439
ord4881
ord5098
ord4625
ord4774
ord4606
ord6897
ord6898
ord6888
ord4772
ord7357
ord9281
ord8304
ord6112
ord888
ord316
ord9399
ord6835
ord11297
ord1296
ord2088
msvcr100
__CxxFrameHandler3
memset
_CxxThrowException
memcpy_s
free
memmove
memcpy
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_setmbcp
??0exception@std@@QAE@ABV01@@Z
_controlfp_s
_invoke_watson
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
isprint
printf
tolower
fclose
fsetpos
_fseeki64
fgetpos
fwrite
setvbuf
fflush
_unlock_file
_lock_file
ungetc
fputc
fgetc
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
memchr
calloc
strtok
kernel32
GetLastError
LocalFree
MultiByteToWideChar
InterlockedDecrement
GetPrivateProfileStringA
EncodePointer
DecodePointer
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
HeapSetInformation
TerminateProcess
GetModuleFileNameA
user32
EnableWindow
LoadIconW
SetTimer
FindWindowA
MessageBoxA
advapi32
RegSetValueExA
RegCloseKey
RegOpenKeyExA
ole32
CoCreateInstance
OleRun
CoInitialize
oleaut32
SysFreeString
VariantClear
SysAllocStringLen
GetErrorInfo
msvcp100
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0_Lockit@std@@QAE@H@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
??1_Lockit@std@@QAE@XZ
?_Incref@facet@locale@std@@QAEXXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?_BADOFF@std@@3_JB
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ