Static task
static1
Behavioral task
behavioral1
Sample
d6f3fef9e39b7b7f0e7b2d29f6cbb213_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d6f3fef9e39b7b7f0e7b2d29f6cbb213_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d6f3fef9e39b7b7f0e7b2d29f6cbb213_JaffaCakes118
-
Size
85KB
-
MD5
d6f3fef9e39b7b7f0e7b2d29f6cbb213
-
SHA1
04b2fab8b8e44a547b8e55ac51746e8b2eafdd6f
-
SHA256
99ab43bf8a9934d01ba9ec6203c95e3c16e6c0dfc633538ab29795ba979b4adf
-
SHA512
9b85656224ec6f053c9b11553d3f82a51f5d3fcaa7e5e64d30707cd067b670d12b530210fe6dcffec6dfc89d758a45c728c6a2ca9d9dc3a6b3be7fc7846afd1c
-
SSDEEP
768:En2IAZ3HbOexil4oWulTojfSe+iJPQv+Kd3uGlAgEQ7s2jNM6dSQnGN7Nar8IwQt:EAHqO6Wf1++QJZHKKSst
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d6f3fef9e39b7b7f0e7b2d29f6cbb213_JaffaCakes118
Files
-
d6f3fef9e39b7b7f0e7b2d29f6cbb213_JaffaCakes118.exe windows:4 windows x64 arch:x64
0a198382df071beccfa7109bb8db9fa3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleW
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetVersionExW
GetProcAddress
GetComputerNameExW
LocalFree
FormatMessageW
FreeLibrary
LoadLibraryW
OpenProcess
ReadProcessMemory
GetLastError
GetCurrentProcess
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
advapi32
IsTextUnicode
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
LogonUserW
msvcp60
??0?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAA@H@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAAAEAV12@AEBV12@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAA@PEBGAEBV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAA@PEBG_KAEBV?$allocator@G@1@@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEBAHAEBV12@@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEBAHPEBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAAAEAV12@PEBG@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAAPEAGXZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAAPEAGXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
?str@?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEBA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAAAEAV12@AEBV12@@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAAAEAV12@PEBG@Z
??_D?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAAXXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAA@AEBV01@@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAAAEAV12@PEBG_K@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAAAEAV01@AEBV01@@Z
??6std@@YAAEAV?$basic_ostream@GU?$char_traits@G@std@@@0@AEAV10@PEBG@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAA@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QEAA@AEBV?$allocator@G@1@@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPEBGXZ@4GB
??1_Winit@std@@QEAA@XZ
??1Init@ios_base@std@@QEAA@XZ
??0_Winit@std@@QEAA@XZ
??0Init@ios_base@std@@QEAA@XZ
?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
?endl@std@@YAAEAV?$basic_ostream@GU?$char_traits@G@std@@@1@AEAV21@@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@G@Z
??6std@@YAAEAV?$basic_ostream@GU?$char_traits@G@std@@@0@AEAV10@AEBV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
secur32
LsaGetLogonSessionData
LsaFreeReturnBuffer
LsaEnumerateLogonSessions
psapi
GetModuleInformation
netapi32
NetApiBufferFree
NetUserGetInfo
msvcrt
_c_exit
_exit
_cexit
exit
__winitenv
__wgetmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
__C_specific_handler
_onexit
__dllonexit
free
toupper
memset
??2@YAPEAX_K@Z
memcmp
memcpy
_wcsicmp
_XcptFilter
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 636B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ