Static task
static1
Behavioral task
behavioral1
Sample
dd73b78f734230276aed188d62541b80_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dd73b78f734230276aed188d62541b80_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dd73b78f734230276aed188d62541b80_JaffaCakes118
-
Size
144KB
-
MD5
dd73b78f734230276aed188d62541b80
-
SHA1
bb9160566ad31891486b877388a12c43ca1ca95b
-
SHA256
c9e987feefeb7d2666ab71b9178b0fe19059a8ef4cfe77541915d8aa8b024c7e
-
SHA512
0390a724a5adbb8189140070ae268cdf7a59ad0f5ead3e1437e56465414681ecb84f40b2685d12ef26d606c84f734557347514423630f06e4f7c66d3061f9205
-
SSDEEP
3072:9eGaGASYWBEonHcbyaKXUZFX2nyFVhd85+cdrWx/QfkRmOqUXu/r1C+3M:9euCDn9XPpsSIvxUXu/r1hM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd73b78f734230276aed188d62541b80_JaffaCakes118
Files
-
dd73b78f734230276aed188d62541b80_JaffaCakes118.exe windows:5 windows x86 arch:x86
02f8243e2e743d5540e42c625b001722
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcirt
?cerr@@3Vostream_withassign@@A
?base@streambuf@@IBEPADXZ
?underflow@stdiobuf@@UAEHXZ
?lock@streambuf@@QAEXXZ
??0strstreambuf@@QAE@H@Z
??_8istrstream@@7B@
??_Efilebuf@@UAEPAXI@Z
??4ostrstream@@QAEAAV0@ABV0@@Z
?lockptr@streambuf@@IAEPAU_CRT_CRITICAL_SECTION@@XZ
??4filebuf@@QAEAAV0@ABV0@@Z
??0exception@@QAE@ABV0@@Z
?sputc@streambuf@@QAEHH@Z
??0exception@@QAE@XZ
?gcount@istream@@QBEHXZ
??0ostream_withassign@@QAE@ABV0@@Z
?rdbuf@ios@@QBEPAVstreambuf@@XZ
??0istream_withassign@@QAE@XZ
?seekp@ostream@@QAEAAV1@JW4seek_dir@ios@@@Z
??5istream@@QAEAAV0@AAE@Z
?stdiofile@stdiobuf@@QAEPAU_iobuf@@XZ
??4Iostream_init@@QAEAAV0@ABV0@@Z
??_Gostrstream@@UAEPAXI@Z
??4stdiobuf@@QAEAAV0@ABV0@@Z
??4fstream@@QAEAAV0@AAV0@@Z
??0ofstream@@QAE@PBDHH@Z
?sync@filebuf@@UAEHXZ
??_8strstream@@7Bistream@@@
?get@istream@@QAEAAV1@AAD@Z
?setbuf@ifstream@@QAEPAVstreambuf@@PADH@Z
??_7strstreambuf@@6B@
??6ostream@@QAEAAV0@D@Z
?is_open@fstream@@QBEHXZ
??6ostream@@QAEAAV0@P6AAAVios@@AAV1@@Z@Z
?cin@@3Vistream_withassign@@A
??0ostream_withassign@@QAE@XZ
??4streambuf@@QAEAAV0@ABV0@@Z
?read@istream@@QAEAAV1@PADH@Z
??_Gostream_withassign@@UAEPAXI@Z
??_8stdiostream@@7Bistream@@@
??0streambuf@@QAE@ABV0@@Z
??0filebuf@@QAE@ABV0@@Z
?pbackfail@streambuf@@UAEHH@Z
dssenh
CPGenKey
CPVerifySignature
CPGetHashParam
CPAcquireContext
CPSetKeyParam
CPReleaseContext
CPSignHash
CPEncrypt
CPDecrypt
CPSetHashParam
CPGetKeyParam
CPHashData
CPDuplicateKey
CPDestroyKey
CPGetUserKey
CPHashSessionKey
CPGetProvParam
CPSetProvParam
CPDestroyHash
CPDuplicateHash
CPExportKey
CPImportKey
CPDeriveKey
CPGenRandom
CPCreateHash
kernel32
InterlockedDecrement
GetSystemWow64DirectoryA
VirtualFree
SetFileShortNameW
VirtualAlloc
FileTimeToLocalFileTime
LocalUnlock
PeekConsoleInputW
GetCommandLineW
GetSystemInfo
VerifyVersionInfoA
IsDebuggerPresent
EnterCriticalSection
SetFileValidData
LeaveCriticalSection
IsValidLocale
EnumDateFormatsA
GetVDMCurrentDirectories
LoadLibraryA
GetExitCodeProcess
GetUserDefaultLangID
BeginUpdateResourceW
AddRefActCtx
RemoveLocalAlternateComputerNameW
ReplaceFileW
GetCalendarInfoA
SetVolumeLabelA
GetSystemDefaultLCID
GetConsoleCursorMode
CreateThread
SetThreadContext
ExpandEnvironmentStringsA
QueryDosDeviceA
GetVersion
IsValidCodePage
ReadConsoleInputW
GetUserDefaultLCID
GetCommConfig
FindNextChangeNotification
msvcp60
?epsilon@?$numeric_limits@D@std@@SADXZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@IIABV?$allocator@G@1@@Z
?_Tidy@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IAEXXZ
??0_Locinfo@std@@QAE@ABV01@@Z
?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
??_F?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$moneypunct@G$00@std@@UAE@XZ
?open@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXPBDF@Z
_FSnan
?lt@?$char_traits@G@std@@SA_NABG0@Z
?infinity@?$numeric_limits@M@std@@SAMXZ
?compare@?$collate@D@std@@QBEHPBD000@Z
?narrow@?$ctype@G@std@@QBEPBGPBG0DPAD@Z
?narrow@?$ctype@D@std@@QBEPBDPBD0DPAD@Z
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
??Dstd@@YA?AV?$complex@O@0@ABV10@ABO@Z
??1strstreambuf@std@@UAE@XZ
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIPBG@Z
_LSinh
?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z
?_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ
??_7?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
??4?$numeric_limits@E@std@@QAEAAV01@ABV01@@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??4?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEAAV01@ABV01@@Z
?readsome@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEHPAGH@Z
??_7?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
?epsilon@?$numeric_limits@G@std@@SAGXZ
??1money_base@std@@UAE@XZ
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?negative_sign@?$_Mpunct@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
??_7?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Init@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXPBDIH@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??0bad_exception@std@@QAE@PBD@Z
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@XZ
??0locale@std@@QAE@ABV01@@Z
??_7bad_alloc@std@@6B@
?imag@?$_Complex_base@O@std@@QAEOABO@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?cosh@std@@YA?AV?$complex@O@1@ABV21@@Z
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0ABV12@@Z
?unsetf@ios_base@std@@QAEXH@Z
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPADH@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?overflow@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?thousands_sep@?$numpunct@D@std@@QBEDXZ
?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
??4?$char_traits@D@std@@QAEAAU01@ABU01@@Z
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??Gstd@@YA?AV?$complex@M@0@ABV10@ABM@Z
_Mbrtowc
setupapi
pSetupGuidFromString
pSetupAccessRunOnceNodeList
SetupFindNextMatchLineA
SetupDeleteErrorW
CM_Get_Device_ID_Size
SetupQueryDrivesInDiskSpaceListA
CM_Request_Eject_PC
SetupDiSelectOEMDrv
SetupDiClassNameFromGuidW
CM_Intersect_Range_List
SetupDiGetClassInstallParamsA
SetupQueueRenameSectionW
SetupDiGetActualSectionToInstallW
SetupVerifyInfFileW
SetupDiOpenDeviceInterfaceRegKey
SetupDiGetCustomDevicePropertyA
CM_Get_Device_Interface_List_SizeA
CM_Setup_DevNode
CM_Get_Log_Conf_Priority
CM_Move_DevNode_Ex
SetupQueueRenameA
CM_Modify_Res_Des_Ex
SetupCommitFileQueueW
CMP_Init_Detection
CM_Get_Class_Registry_PropertyW
SetupGetLineByIndexA
SetupDiGetClassDevsExW
imagehlp
BindImageEx
SymLoadModule64
CheckSumMappedFile
BindImage
SetImageConfigInformation
SymCleanup
SymFunctionTableAccess64
SymFromName
SymFunctionTableAccess
FindExecutableImage
SymEnumerateModules64
GetImageUnusedHeaderBytes
MapAndLoad
SymGetLinePrev64
RemovePrivateCvSymbolicEx
ImagehlpApiVersionEx
SymGetLineFromName64
ImageGetCertificateHeader
SymEnumSym
SymUnDName64
StackWalk64
SymUnloadModule
EnumerateLoadedModules
SymRegisterCallback64
ImageAddCertificate
SymGetOptions
SymGetLineNext64
SymEnumerateModules
ImageRvaToVa
GetImageConfigInformation
SymEnumerateSymbols64
UnMapAndLoad
FindDebugInfoFile
ImageLoad
ReBaseImage64
ReBaseImage
ImageGetCertificateData
ImageRvaToSection
lz32
LZInit
LZCopy
LZClose
GetExpandedNameA
LZOpenFileA
LZOpenFileW
LZRead
LZSeek
LZCloseFile
LZStart
CopyLZFile
LZDone
Sections
.text Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 243KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ