Static task
static1
Behavioral task
behavioral1
Sample
d2e0ca5194795f9aa10e7b29e504b484_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2e0ca5194795f9aa10e7b29e504b484_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d2e0ca5194795f9aa10e7b29e504b484_JaffaCakes118
-
Size
43KB
-
MD5
d2e0ca5194795f9aa10e7b29e504b484
-
SHA1
3385cb56fa887d823c27bce78b53184cd096e057
-
SHA256
feceb2617ef04a71098cd8a80bc194da19716ef09b9a9fdcf88786325b536c3d
-
SHA512
836ba57a57ed9fd88ead753c304d25beee73c2f7fb31c5bfcdbed99da90e7626a1b0946385a3a40aba0a80bb2e9c7c7955e59a1bfa8cba69b1cb6898ad391ab6
-
SSDEEP
768:WDgRbjTIshHq7e4ftFFGpra1PD+szMCdknfis:WDgRTIshHq7e4ljCreyXrB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2e0ca5194795f9aa10e7b29e504b484_JaffaCakes118
Files
-
d2e0ca5194795f9aa10e7b29e504b484_JaffaCakes118.exe windows:5 windows x86 arch:x86
15cf53d2f7fb5af7c682fbd19b7849c4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp60
?_Addcats@_Locinfo@std@@QAEAAV12@HPBD@Z
?isfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?do_decimal_point@?$_Mpunct@G@std@@MBEGXZ
?length@?$codecvt@DDH@std@@QBEHAAHPBD1I@Z
??1?$collate@D@std@@UAE@XZ
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?overflow@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
??_F?$messages@G@std@@QAEXXZ
?_Getcat@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIXZ
??Kstd@@YA?AV?$complex@O@0@ABV10@0@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?register_callback@ios_base@std@@QAEXP6AXW4event@12@AAV12@H@ZH@Z
??Nstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?do_always_noconv@?$codecvt@GDH@std@@MBE_NXZ
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??_F?$codecvt@GDH@std@@QAEXXZ
??_F?$complex@O@std@@QAEXXZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?sync@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@PBDH@Z
??0?$ctype@G@std@@QAE@I@Z
?peek@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDF@Z
?round_error@?$numeric_limits@H@std@@SAHXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@M@Z
??1?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?eq@?$char_traits@D@std@@SA_NABD0@Z
??Hstd@@YA?AV?$complex@O@0@ABOABV10@@Z
wininet
InternetConfirmZoneCrossing
FreeUrlCacheSpaceW
InternetAlgIdToStringW
ParseX509EncodedCertificateForListBoxEntry
InternetShowSecurityInfoByURL
InternetSetCookieA
GetUrlCacheHeaderData
HttpEndRequestA
FtpOpenFileW
GetUrlCacheConfigInfoA
InternetSetDialState
InternetSetCookieExA
InternetGetLastResponseInfoW
InternetOpenA
FtpGetCurrentDirectoryW
InternetTimeFromSystemTimeW
InternetSetPerSiteCookieDecisionW
FtpRemoveDirectoryA
InternetSetCookieW
FtpOpenFileA
CreateMD5SSOHash
glu32
gluGetNurbsProperty
gluBeginSurface
gluTessNormal
gluPwlCurve
gluTessBeginPolygon
gluOrtho2D
gluPickMatrix
gluTessEndContour
gluGetString
gluUnProject
gluScaleImage
gluTessVertex
gluQuadricCallback
gluDisk
gluQuadricTexture
gluErrorString
gluPartialDisk
gluDeleteNurbsRenderer
gluSphere
gluQuadricNormals
gluEndSurface
gluDeleteTess
gluQuadricOrientation
gluBuild2DMipmaps
gluPerspective
cfgmgr32
CM_Detect_Resource_Conflict
CM_First_Range
CM_Query_Remove_SubTree_Ex
CM_Get_Log_Conf_Priority_Ex
CM_Get_Child_Ex
CM_Setup_DevNode
CM_Get_HW_Prof_Flags_ExA
CM_Get_Depth
CM_Modify_Res_Des
CM_Create_DevNode_ExA
CM_Move_DevNode
CM_Get_Class_Key_Name_ExA
CM_Free_Res_Des_Ex
CM_Get_Global_State_Ex
CM_Get_Parent
CM_Register_Device_Driver
CM_Get_Device_ID_ExA
CM_Get_Device_Interface_Alias_ExW
CM_Detect_Resource_Conflict_Ex
CM_Set_HW_Prof_FlagsA
CM_Enumerate_Classes_Ex
CM_Unregister_Device_Interface_ExA
CM_Request_Eject_PC_Ex
CMP_RegisterNotification
CM_Set_Class_Registry_PropertyA
CM_Set_DevNode_Registry_Property_ExA
CM_Get_Device_ID_List_SizeA
CM_Register_Device_InterfaceW
kernel32
GetModuleHandleA
GetSystemTime
SetNamedPipeHandleState
LZCreateFileW
InterlockedDecrement
SetSystemTime
GetCurrentConsoleFont
lstrcat
GetProcessWorkingSetSize
_lclose
GetFileAttributesExA
LoadLibraryA
FatalExit
RaiseException
LZClose
GetConsoleAliasExesW
CreateJobObjectA
ReadConsoleOutputAttribute
VirtualAlloc
CreateActCtxA
EnumResourceTypesA
GetPrivateProfileSectionNamesW
GetSystemWindowsDirectoryA
ReadConsoleW
SetConsoleHardwareState
wintrust
CryptCATCDFEnumAttributesWithCDFTag
mssip32DllUnregisterServer
CryptCATCDFEnumCatAttributes
CryptCATAdminPauseServiceForBackup
WVTAsn1CatNameValueDecode
CryptCATAdminReleaseContext
WVTAsn1SpcMinimalCriteriaInfoDecode
CryptCATAdminResolveCatalogPath
WintrustGetRegPolicyFlags
CryptSIPRemoveSignedDataMsg
WVTAsn1SpcLinkEncode
WTHelperCheckCertUsage
WintrustAddDefaultForUsage
WTHelperGetFileHash
WVTAsn1SpcFinancialCriteriaInfoDecode
MsCatFreeHashTag
CryptSIPCreateIndirectData
CryptCATPutCatAttrInfo
SoftpubCleanup
TrustIsCertificateSelfSigned
Sections
.text Size: 1024B - Virtual size: 622B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ