Static task
static1
Behavioral task
behavioral1
Sample
d63a4f108b36536563c08118e1649878_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d63a4f108b36536563c08118e1649878_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d63a4f108b36536563c08118e1649878_JaffaCakes118
-
Size
236KB
-
MD5
d63a4f108b36536563c08118e1649878
-
SHA1
fdd66e3e6106fd52c48d8fb881b3e13e0baabaad
-
SHA256
5338957b6bac3b28b8e4e41f9382651634889be0d7613dfe7a45ce0e4d52150d
-
SHA512
ab8089b3025d00663f1b7c2f73c9d334ffb4b74cd240cd809079e3b34baa32616189f31a627bb4bd96d72e8c8d62c7286cbfd1cac529df122ea4c91e920f39ce
-
SSDEEP
6144:aUapO6k7loGGQGUlJbJO9Myf36rJs4WbJlaDIe3VgXlVgxr/:aUQM9+9ItFgVUr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d63a4f108b36536563c08118e1649878_JaffaCakes118
Files
-
d63a4f108b36536563c08118e1649878_JaffaCakes118.exe windows:4 windows x86 arch:x86
33c6208bec250b88099f0baa051b0b07
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord6877
ord4234
ord2379
ord755
ord470
ord6663
ord823
ord6282
ord6283
ord6662
ord4129
ord4277
ord2614
ord1168
ord2818
ord860
ord858
ord535
ord537
ord941
ord825
ord561
ord540
ord815
ord800
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord4673
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord1576
msvcrt
??1exception@@UAE@XZ
_setmbcp
_except_handler3
__set_app_type
__CxxFrameHandler
strtok
fclose
fwrite
fopen
fread
ftell
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
fseek
rand
srand
time
_splitpath
_mbsicmp
sprintf
malloc
??0exception@@QAE@ABV0@@Z
_controlfp
??0exception@@QAE@ABQBD@Z
_CxxThrowException
_purecall
__dllonexit
_onexit
kernel32
SetEvent
CloseHandle
FindResourceA
LoadResource
LockResource
GetCommandLineA
lstrcmpA
Sleep
DeleteFileA
FindFirstFileA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrlenA
GetLastError
Module32Next
Module32First
OpenEventA
Process32Next
Process32First
CreateFileA
LocalFree
FormatMessageA
SetFileTime
SetFileAttributesA
GetFileAttributesA
GetStartupInfoA
GetModuleFileNameA
GetModuleHandleA
SystemTimeToFileTime
GetLocalTime
FindClose
CreateToolhelp32Snapshot
SizeofResource
CreateDirectoryA
user32
GetSystemMetrics
IsIconic
DrawIcon
MessageBoxA
GetClientRect
SendMessageA
CharNextA
advapi32
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
msvcp60
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??_8?$basic_ifstream@DU?$char_traits@D@std@@@std@@7B@
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??_7?$basic_ifstream@DU?$char_traits@D@std@@@std@@6B@
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??_8?$basic_ofstream@DU?$char_traits@D@std@@@std@@7B@
??_7?$basic_ofstream@DU?$char_traits@D@std@@@std@@6B@
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1ostrstream@std@@UAE@XZ
??1strstreambuf@std@@UAE@XZ
?_Init@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@XZ
?_Global@_Locimp@locale@std@@0PAV123@A
??1_Lockit@std@@QAE@XZ
?_Init@strstreambuf@std@@IAEXHPAD0H@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?overflow@strstreambuf@std@@MAEHH@Z
?pbackfail@strstreambuf@std@@MAEHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?underflow@strstreambuf@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPBDH@Z
?seekoff@strstreambuf@std@@MAE?AV?$fpos@H@2@JW4seekdir@ios_base@2@H@Z
?seekpos@strstreambuf@std@@MAE?AV?$fpos@H@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?ends@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?freeze@strstreambuf@std@@QAEX_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??0runtime_error@std@@QAE@ABV01@@Z
??1runtime_error@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??_7runtime_error@std@@6B@
wininet
InternetOpenUrlA
InternetOpenA
InternetReadFile
InternetCloseHandle
netapi32
Netbios
Sections
.text Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 180KB - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE