Static task
static1
Behavioral task
behavioral1
Sample
f0774befe2aa6e43c8cc8bdfcdc90d43_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f0774befe2aa6e43c8cc8bdfcdc90d43_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f0774befe2aa6e43c8cc8bdfcdc90d43_JaffaCakes118
-
Size
85KB
-
MD5
f0774befe2aa6e43c8cc8bdfcdc90d43
-
SHA1
9ba37badd3b3624384b856059df016b8e1c37d46
-
SHA256
a3016b726a5fa83013d19643210086ea02e5b2b009ea2e139ec831e2283324b9
-
SHA512
ade7493686764bcaf60285f2f88a6bff742f56c411a9e74b443a198c24b7be7417eafea84c49e1e87a0e7db15138eab9f4629db2f72105951d1865d9de81f3d9
-
SSDEEP
1536:BS6jiGGzDvaflLRDVfqXn2EvgboOSGtCexhs2V6kfIzwxtrVePTJGUGrY:BS6AHaJRDVflGeUawoyWrY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f0774befe2aa6e43c8cc8bdfcdc90d43_JaffaCakes118
Files
-
f0774befe2aa6e43c8cc8bdfcdc90d43_JaffaCakes118.exe windows:5 windows x86 arch:x86
b3a290114c204b9bc6390f8b542033c9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfcsubs
?GetUpperBound@CStringArray@@QBEHXZ
??0CMapStringToPtr@@QAE@H@Z
?Create@CPlex@@SGPAU1@AAPAU1@II@Z
??1CSyncObject@@UAE@XZ
??_7CSyncObject@@6B@
?Mid@CString@@QBE?AV1@H@Z
?Left@CString@@QBE?AV1@H@Z
?CompareNoCase@CString@@QBEHPBG@Z
?Unlock@CCriticalSection@@UAEHXZ
?SpanExcluding@CString@@QBE?AV1@PBG@Z
?ConcatInPlace@CString@@IAEXHPBG@Z
?Lock@CSyncObject@@UAEHK@Z
?Release@CString@@IAEXXZ
??4CPlex@@QAEAAU0@ABU0@@Z
??H@YG?AVCString@@ABV0@0@Z
??_FCMapStringToPtr@@QAEXXZ
?MakeLower@CString@@QAEXXZ
??ACString@@QBEGH@Z
??1CStringArray@@UAE@XZ
?SetAtGrow@CStringArray@@QAEXHPBG@Z
?FreeDataChain@CPlex@@QAEXXZ
??H@YG?AVCString@@GABV0@@Z
msvcrt20
__p__tzname
??6ostream@@QAEAAV0@PBC@Z
_tcsnccmp
setlocale
??_7istream@@6B@
_global_unwind2
rewind
_tcsncicmp
isalnum
??4ostream_withassign@@QAEAAVostream@@PAVstreambuf@@@Z
?open@fstream@@QAEXPBDHH@Z
??0ofstream@@QAE@H@Z
??_7stdiostream@@6B@
??4Iostream_init@@QAEAAV0@ABV0@@Z
_mbsnbicoll
kernel32
SetFirmwareEnvironmentVariableW
GetLastError
DebugBreak
VirtualQuery
ReplaceFileA
VirtualAlloc
RegisterConsoleOS2
CreateSocketHandle
HeapCreate
EnumSystemCodePagesW
GetTickCount
VDMOperationStarted
RemoveLocalAlternateComputerNameW
CancelIo
InterlockedDecrement
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoA
GetThreadPriority
IsBadStringPtrA
EnumSystemGeoID
GetSystemTimeAsFileTime
ConvertFiberToThread
LoadLibraryA
GetCurrentProcessId
msls31
LsdnSubmitSublines
LssbFDonePresSubline
LssbGetDurTrailInSubline
LsSetModWidthPairs
LsExpandSubline
LsPointUV2FromPointUV1
LsGetSpecialEffectsSubline
LsGetTatenakayokoLsimethods
LsdnFinishBySubline
LsdnQueryPenNode
LsdnResolvePrevTab
LsdnGetCurTabInfo
LsdnGetDup
LsSetBreakSubline
LsCompressSubline
LsDestroyContext
LsDestroySubline
LssbFDoneDisplay
LssbGetNumberDnodesInSubline
LsGetReverseLsimethods
LsdnDistribute
wldap32
ldap_modrdn2
ldap_open
ldap_explode_dnA
ldap_get_values_len
ldap_bindW
ldap_modify_ext_s
ldap_free_controlsA
ldap_deleteW
ldap_value_free_len
ldap_parse_sort_controlW
ldap_set_dbg_routine
ldap_count_valuesW
ldap_modrdnA
LdapUTF8ToUnicode
ldap_modrdn2A
LdapMapErrorToWin32
ldap_search_stA
ldap_create_sort_controlW
Sections
.text Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ