Static task
static1
Behavioral task
behavioral1
Sample
cefb5a86ad261e9386fd92bdc841c36c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cefb5a86ad261e9386fd92bdc841c36c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
cefb5a86ad261e9386fd92bdc841c36c_JaffaCakes118
-
Size
71KB
-
MD5
cefb5a86ad261e9386fd92bdc841c36c
-
SHA1
a2ee7b0d3353d885edd3a5b940477a4dafac5f96
-
SHA256
485fdf1a2c3234d047482428824dac808f2d7e03c4c97dfbe8644e02f8a55008
-
SHA512
fe592f40e3602e9988d6b29d39c393f923e8153556b15c48e41b528f4f405eb912b719ac2d27fd4c3320aa78b29f6aa7605d2eb7aa18d977dc6fb8766d330eec
-
SSDEEP
1536:Dvpa3CJd3eGaGwc6g53HJYhUBEoxb+6HIfLHyak6RfQX4jYRSZPkGX9JI+:9eGaGASYWBEonHcbyaKXUZFXD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cefb5a86ad261e9386fd92bdc841c36c_JaffaCakes118
Files
-
cefb5a86ad261e9386fd92bdc841c36c_JaffaCakes118.exe windows:5 windows x86 arch:x86
02f8243e2e743d5540e42c625b001722
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcirt
?cerr@@3Vostream_withassign@@A
?base@streambuf@@IBEPADXZ
?underflow@stdiobuf@@UAEHXZ
?lock@streambuf@@QAEXXZ
??0strstreambuf@@QAE@H@Z
??_8istrstream@@7B@
??_Efilebuf@@UAEPAXI@Z
??4ostrstream@@QAEAAV0@ABV0@@Z
?lockptr@streambuf@@IAEPAU_CRT_CRITICAL_SECTION@@XZ
??4filebuf@@QAEAAV0@ABV0@@Z
??0exception@@QAE@ABV0@@Z
?sputc@streambuf@@QAEHH@Z
??0exception@@QAE@XZ
?gcount@istream@@QBEHXZ
??0ostream_withassign@@QAE@ABV0@@Z
?rdbuf@ios@@QBEPAVstreambuf@@XZ
??0istream_withassign@@QAE@XZ
?seekp@ostream@@QAEAAV1@JW4seek_dir@ios@@@Z
??5istream@@QAEAAV0@AAE@Z
?stdiofile@stdiobuf@@QAEPAU_iobuf@@XZ
??4Iostream_init@@QAEAAV0@ABV0@@Z
??_Gostrstream@@UAEPAXI@Z
??4stdiobuf@@QAEAAV0@ABV0@@Z
??4fstream@@QAEAAV0@AAV0@@Z
??0ofstream@@QAE@PBDHH@Z
?sync@filebuf@@UAEHXZ
??_8strstream@@7Bistream@@@
?get@istream@@QAEAAV1@AAD@Z
?setbuf@ifstream@@QAEPAVstreambuf@@PADH@Z
??_7strstreambuf@@6B@
??6ostream@@QAEAAV0@D@Z
?is_open@fstream@@QBEHXZ
??6ostream@@QAEAAV0@P6AAAVios@@AAV1@@Z@Z
?cin@@3Vistream_withassign@@A
??0ostream_withassign@@QAE@XZ
??4streambuf@@QAEAAV0@ABV0@@Z
?read@istream@@QAEAAV1@PADH@Z
??_Gostream_withassign@@UAEPAXI@Z
??_8stdiostream@@7Bistream@@@
??0streambuf@@QAE@ABV0@@Z
??0filebuf@@QAE@ABV0@@Z
?pbackfail@streambuf@@UAEHH@Z
dssenh
CPGenKey
CPVerifySignature
CPGetHashParam
CPAcquireContext
CPSetKeyParam
CPReleaseContext
CPSignHash
CPEncrypt
CPDecrypt
CPSetHashParam
CPGetKeyParam
CPHashData
CPDuplicateKey
CPDestroyKey
CPGetUserKey
CPHashSessionKey
CPGetProvParam
CPSetProvParam
CPDestroyHash
CPDuplicateHash
CPExportKey
CPImportKey
CPDeriveKey
CPGenRandom
CPCreateHash
kernel32
InterlockedDecrement
GetSystemWow64DirectoryA
VirtualFree
SetFileShortNameW
VirtualAlloc
FileTimeToLocalFileTime
LocalUnlock
PeekConsoleInputW
GetCommandLineW
GetSystemInfo
VerifyVersionInfoA
IsDebuggerPresent
EnterCriticalSection
SetFileValidData
LeaveCriticalSection
IsValidLocale
EnumDateFormatsA
GetVDMCurrentDirectories
LoadLibraryA
GetExitCodeProcess
GetUserDefaultLangID
BeginUpdateResourceW
AddRefActCtx
RemoveLocalAlternateComputerNameW
ReplaceFileW
GetCalendarInfoA
SetVolumeLabelA
GetSystemDefaultLCID
GetConsoleCursorMode
CreateThread
SetThreadContext
ExpandEnvironmentStringsA
QueryDosDeviceA
GetVersion
IsValidCodePage
ReadConsoleInputW
GetUserDefaultLCID
GetCommConfig
FindNextChangeNotification
msvcp60
?epsilon@?$numeric_limits@D@std@@SADXZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@IIABV?$allocator@G@1@@Z
?_Tidy@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IAEXXZ
??0_Locinfo@std@@QAE@ABV01@@Z
?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
??_F?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$moneypunct@G$00@std@@UAE@XZ
?open@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXPBDF@Z
_FSnan
?lt@?$char_traits@G@std@@SA_NABG0@Z
?infinity@?$numeric_limits@M@std@@SAMXZ
?compare@?$collate@D@std@@QBEHPBD000@Z
?narrow@?$ctype@G@std@@QBEPBGPBG0DPAD@Z
?narrow@?$ctype@D@std@@QBEPBDPBD0DPAD@Z
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
??Dstd@@YA?AV?$complex@O@0@ABV10@ABO@Z
??1strstreambuf@std@@UAE@XZ
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIPBG@Z
_LSinh
?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z
?_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ
??_7?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
??4?$numeric_limits@E@std@@QAEAAV01@ABV01@@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??4?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEAAV01@ABV01@@Z
?readsome@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEHPAGH@Z
??_7?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
?epsilon@?$numeric_limits@G@std@@SAGXZ
??1money_base@std@@UAE@XZ
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?negative_sign@?$_Mpunct@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
??_7?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Init@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXPBDIH@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??0bad_exception@std@@QAE@PBD@Z
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@XZ
??0locale@std@@QAE@ABV01@@Z
??_7bad_alloc@std@@6B@
?imag@?$_Complex_base@O@std@@QAEOABO@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?cosh@std@@YA?AV?$complex@O@1@ABV21@@Z
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0ABV12@@Z
?unsetf@ios_base@std@@QAEXH@Z
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPADH@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?overflow@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?thousands_sep@?$numpunct@D@std@@QBEDXZ
?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
??4?$char_traits@D@std@@QAEAAU01@ABU01@@Z
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??Gstd@@YA?AV?$complex@M@0@ABV10@ABM@Z
_Mbrtowc
setupapi
pSetupGuidFromString
pSetupAccessRunOnceNodeList
SetupFindNextMatchLineA
SetupDeleteErrorW
CM_Get_Device_ID_Size
SetupQueryDrivesInDiskSpaceListA
CM_Request_Eject_PC
SetupDiSelectOEMDrv
SetupDiClassNameFromGuidW
CM_Intersect_Range_List
SetupDiGetClassInstallParamsA
SetupQueueRenameSectionW
SetupDiGetActualSectionToInstallW
SetupVerifyInfFileW
SetupDiOpenDeviceInterfaceRegKey
SetupDiGetCustomDevicePropertyA
CM_Get_Device_Interface_List_SizeA
CM_Setup_DevNode
CM_Get_Log_Conf_Priority
CM_Move_DevNode_Ex
SetupQueueRenameA
CM_Modify_Res_Des_Ex
SetupCommitFileQueueW
CMP_Init_Detection
CM_Get_Class_Registry_PropertyW
SetupGetLineByIndexA
SetupDiGetClassDevsExW
imagehlp
BindImageEx
SymLoadModule64
CheckSumMappedFile
BindImage
SetImageConfigInformation
SymCleanup
SymFunctionTableAccess64
SymFromName
SymFunctionTableAccess
FindExecutableImage
SymEnumerateModules64
GetImageUnusedHeaderBytes
MapAndLoad
SymGetLinePrev64
RemovePrivateCvSymbolicEx
ImagehlpApiVersionEx
SymGetLineFromName64
ImageGetCertificateHeader
SymEnumSym
SymUnDName64
StackWalk64
SymUnloadModule
EnumerateLoadedModules
SymRegisterCallback64
ImageAddCertificate
SymGetOptions
SymGetLineNext64
SymEnumerateModules
ImageRvaToVa
GetImageConfigInformation
SymEnumerateSymbols64
UnMapAndLoad
FindDebugInfoFile
ImageLoad
ReBaseImage64
ReBaseImage
ImageGetCertificateData
ImageRvaToSection
lz32
LZInit
LZCopy
LZClose
GetExpandedNameA
LZOpenFileA
LZOpenFileW
LZRead
LZSeek
LZCloseFile
LZStart
CopyLZFile
LZDone
Sections
.text Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 243KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ