Static task
static1
Behavioral task
behavioral1
Sample
e235b1e7f601cd536d40a8260e08d3aa_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e235b1e7f601cd536d40a8260e08d3aa_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e235b1e7f601cd536d40a8260e08d3aa_JaffaCakes118
-
Size
52KB
-
MD5
e235b1e7f601cd536d40a8260e08d3aa
-
SHA1
9d2564a29dfaa363b2424987f6379c5ad5f3831a
-
SHA256
e698333cf80c7cbbae530cdaa7c98bfa5b58041363040ca996689bfca3eef25b
-
SHA512
25648aa4bf9fcf120f3677b9f718ee9340604a38f1ef744223b9acee80353fd94774d53c3da547254fa350df80442b1c05ae459d0d049c365525fdda271d699c
-
SSDEEP
768:Jte+gQRGlpVvKLe3xGaOBrSBYYYo3ooo3PcYkyLqK+0I9XP:htR+tGeBUJQ7RP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e235b1e7f601cd536d40a8260e08d3aa_JaffaCakes118
Files
-
e235b1e7f601cd536d40a8260e08d3aa_JaffaCakes118.exe windows:4 windows x86 arch:x86
105407cc5718abd36de00b76de38aa03
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
FreeLibrary
FindClose
FindNextFileA
FindFirstFileA
GetWindowsDirectoryA
MultiByteToWideChar
MoveFileExA
SetFileAttributesA
GetModuleFileNameA
_lwrite
_lcreat
_lclose
Sleep
_lopen
ExpandEnvironmentStringsA
GlobalUnlock
GlobalLock
TerminateThread
CreateThread
CreateMutexA
GetLastError
ExitProcess
GetSystemTime
GetStartupInfoA
GetModuleHandleA
GetTickCount
WinExec
GetSystemDirectoryA
GetTempPathA
GetTempFileNameA
DeleteFileA
LoadLibraryA
GetProcAddress
GetFileSize
ReadFile
CreateFileA
WriteFile
SetFileTime
CloseHandle
_lread
GetFileAttributesA
user32
GetDC
DdeFreeStringHandle
GetMessageA
TranslateMessage
DispatchMessageA
GetAsyncKeyState
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
FindWindowA
DdeInitializeA
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeAccessData
DdeDisconnect
DdeUninitialize
GetDesktopWindow
GetWindowRect
gdi32
SelectObject
BitBlt
CreateCompatibleDC
GetDeviceCaps
GetBitmapBits
CreateBitmap
DeleteObject
CreateCompatibleBitmap
advapi32
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
shell32
ShellExecuteW
StrStrIA
ShellExecuteA
CommandLineToArgvW
SHGetSpecialFolderPathA
ole32
CoInitialize
CoCreateInstance
msvcrt
_strcmpi
??3@YAXPAX@Z
??2@YAPAXI@Z
mbstowcs
free
wcscmp
malloc
__CxxFrameHandler
_splitpath
sprintf
fclose
fwrite
fopen
_getcwd
_chdir
rand
srand
memmove
_ltoa
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
msvcp60
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@II@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Xlen@std@@YAXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
urlmon
URLDownloadToFileA
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
ws2_32
WSAStartup
send
closesocket
connect
htons
inet_addr
inet_ntoa
gethostbyname
socket
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE