Static task
static1
Behavioral task
behavioral1
Sample
ef1725ef49a29b0950f454f1090615c6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef1725ef49a29b0950f454f1090615c6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ef1725ef49a29b0950f454f1090615c6_JaffaCakes118
-
Size
63KB
-
MD5
ef1725ef49a29b0950f454f1090615c6
-
SHA1
718a28bbeb9706846f7c64e482afeb2facf26336
-
SHA256
9e78812692247eaf7a0d6616f08448749116e1d9ca7856c26717811e29367435
-
SHA512
1088d9887e35b3c594d63c53dcd2d39ae94890bfdd872cea6f9166de6ee2844675fb469a6e15589dbb3e0fe9b11292c53b75a5c9f56cf1367dfbb6acd2d9b74c
-
SSDEEP
1536:SDj4xoGFYK2qIfmEi3pddB7YXQMdh3DF3USAPpJHV6:8s2QW3i/dBOH3LA16
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef1725ef49a29b0950f454f1090615c6_JaffaCakes118
Files
-
ef1725ef49a29b0950f454f1090615c6_JaffaCakes118.exe windows:5 windows x86 arch:x86
e5d8e7c6e87604763855fd86f97f1911
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt20
??1strstream@@UAE@XZ
_cprintf
??Bios@@QBEPAXXZ
??_Estdiobuf@@UAEPAXI@Z
wcscspn
__p__pgmptr
gmtime
??0fstream@@QAE@HPADH@Z
_itow
_spawnv
??0istream_withassign@@QAE@ABV0@@Z
_cabs
??1fstream@@UAE@XZ
getc
_ismbbalpha
??_Dfstream@@QAEXXZ
?setrwbuf@stdiobuf@@QAEHHH@Z
?get@istream@@QAEHXZ
_nextafter
?dec@@YAAAVios@@AAV1@@Z
_stricmp
_tcslwr
??0ostrstream@@QAE@XZ
ldiv
_heapset
??1istrstream@@UAE@XZ
??_8istrstream@@7B@
putc
rename
_endthread
_open
_mbsnset
_ismbcprint
_mbbtype
??0filebuf@@QAE@HPADH@Z
_fgetchar
?fd@ifstream@@QBEHXZ
?get@istream@@QAEAAV1@PAEHD@Z
_findclose
_tcsupr
iswcntrl
?attach@filebuf@@QAEPAV1@H@Z
?fd@fstream@@QBEHXZ
??_Distream@@QAEXXZ
_mbsset
_searchenv
__p__winminor
_wunlink
strspn
?setb@streambuf@@IAEXPAD0H@Z
_CIexp
?pbackfail@stdiobuf@@UAEHH@Z
??_Gistrstream@@UAEPAXI@Z
_mbscspn
wldap32
ldap_search_s
ldap_modify_sA
ldap_set_dbg_flags
ldap_sslinitW
ldap_bind
ldap_result
ldap_search_stW
ldap_add_ext
ldap_value_freeW
ldap_first_attributeW
ldap_parse_page_controlW
ldap_check_filterW
ldap_parse_resultW
ldap_modify_ext_sA
ldap_unbind_s
ldap_modifyA
ldap_start_tls_sA
ldap_count_values_len
ldap_search_abandon_page
ldap_count_valuesW
ldap_parse_resultA
ldap_rename_ext
ber_printf
ldap_compare_ext_sA
crtdll
strspn
fseek
_lseek
_ismbslead
_strncnt
ldiv
swprintf
_getche
ftell
_fgetchar
fread
_ismbclower
fgets
_j0
_getcwd
getc
sin
wcsncmp
modf
_getch
iswdigit
msvcp60
?quiet_NaN@?$numeric_limits@H@std@@SAHXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Getcat@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIXZ
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PAG0PBG1@Z
?do_widen@?$ctype@G@std@@MBEGD@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
??_Fcodecvt_base@std@@QAEXXZ
??0?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAE@PAU_iobuf@@@Z
??_7ctype_base@std@@6B@
?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@V32@F@Z
?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?max@?$numeric_limits@J@std@@SAJXZ
?_Init@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IID@Z
??1?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
??X?$_Complex_base@O@std@@QAEAAV01@ABO@Z
??0bad_typeid@std@@QAE@ABV01@@Z
??4?$complex@M@std@@QAEAAV01@ABV01@@Z
?do_thousands_sep@?$_Mpunct@D@std@@MBEDXZ
?thousands_sep@?$numpunct@G@std@@QBEGXZ
?_Isnan@?$_Ctr@N@std@@SA_NN@Z
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@HH@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGPAGG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
??0?$ctype@G@std@@QAE@I@Z
?_Tidy@strstreambuf@std@@IAEXXZ
?max@?$numeric_limits@M@std@@SAMXZ
kernel32
SetProcessAffinityMask
WideCharToMultiByte
GetTempPathW
GetModuleHandleW
EnumCalendarInfoW
TerminateProcess
GetTickCount
SetThreadContext
GetCurrentConsoleFont
GetVersionExW
SetSystemTime
SetUnhandledExceptionFilter
CompareFileTime
WriteProfileStringW
EnumResourceNamesA
GetCurrentProcessId
SetLastConsoleEventActive
WritePrivateProfileSectionA
GetConsoleKeyboardLayoutNameA
VirtualAlloc
ConvertThreadToFiber
GetConsoleTitleW
GetSystemTime
GetProcAddress
GetStartupInfoW
LoadLibraryA
DeleteCriticalSection
WriteConsoleInputA
EndUpdateResourceW
QueryPerformanceCounter
LoadLibraryW
EnumDateFormatsA
DebugActiveProcessStop
AddRefActCtx
RegisterWaitForSingleObject
EnumResourceLanguagesW
CopyLZFile
GetFileSizeEx
SetThreadAffinityMask
GetCurrentThreadId
dbghelp
SymGetLineFromName64
MapDebugInformation
SymLoadModuleEx
SymUnloadModule64
SymGetSymPrev
SymUnDName64
ImageRvaToSection
SymFromName
SymGetTypeInfo
SymGetSymNext64
FindExecutableImageEx
WinDbgExtensionDllInit
SymUnloadModule
SymGetLinePrev
DbgHelpCreateUserDumpW
vc7fpo
SymGetSymNext
EnumerateLoadedModules64
lmi
SymGetLineFromAddr
SymGetLinePrev64
sym
MiniDumpWriteDump
SymRegisterFunctionEntryCallback64
SymSetOptions
SymEnumSym
FindFileInSearchPath
ImageNtHeader
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ