Static task
static1
Behavioral task
behavioral1
Sample
f559a2b2713f7d6e5ed0ac4ea9f0e8c9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f559a2b2713f7d6e5ed0ac4ea9f0e8c9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f559a2b2713f7d6e5ed0ac4ea9f0e8c9_JaffaCakes118
-
Size
59KB
-
MD5
f559a2b2713f7d6e5ed0ac4ea9f0e8c9
-
SHA1
723a97465fad697c73c13246ae33c950595ce1d0
-
SHA256
1e7d2c626b741a4a5460e4690cd3f670600808f73de56bc3887caeb7020491c4
-
SHA512
852b0ceeb4424e7973a9d476bf54f3eef35d73f8d00a0d63c07303841c3d60bcc93f1333e23d2f2ab5f65ac8a0029d53cf6983c61113aba4b2cca58861ed5971
-
SSDEEP
1536:6oKH+FbjDXRjoeo+MOxj2oJ9KrLNXDw568+:6LgbjDXBoeIyj2oPAJgS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f559a2b2713f7d6e5ed0ac4ea9f0e8c9_JaffaCakes118
Files
-
f559a2b2713f7d6e5ed0ac4ea9f0e8c9_JaffaCakes118.exe windows:5 windows x86 arch:x86
04cb24549bc8bf5637a8c875cd2e000d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
odbcbcp
SQLInitEnumServers
LibMain
bcp_control
bcp_readfmtA
bcp_colfmt
bcp_exec
dbprtypeW
SQLLinkedCatalogsA
bcp_done
bcp_collen
SQLLinkedServers
bcp_sendrow
SQLCloseEnumServers
bcp_columns
bcp_writefmtA
bcp_moretext
SQLLinkedCatalogsW
dbprtypeA
bcp_readfmtW
bcp_batch
bcp_setcolfmt
bcp_writefmtW
bcp_colptr
bcp_bind
bcp_initA
kernel32
LoadLibraryA
SetConsoleHardwareState
GetConsoleCommandHistoryW
DebugActiveProcess
ResumeThread
SetFilePointerEx
CloseHandle
GetConsoleSelectionInfo
DebugActiveProcessStop
GetPrivateProfileStructA
FileTimeToDosDateTime
EndUpdateResourceW
SetThreadPriority
GlobalAddAtomA
OpenEventW
GetCurrencyFormatA
CreateFileMappingW
GetLastError
VirtualAlloc
DefineDosDeviceA
DeleteTimerQueueTimer
OpenMutexA
GetPrivateProfileStringA
GetNumaAvailableMemoryNode
DeleteVolumeMountPointA
GetCommState
FlushInstructionCache
SetComputerNameExW
GetCommModemStatus
GetTapePosition
SetCurrentDirectoryW
WriteConsoleInputA
GetLogicalDriveStringsA
HeapCreate
GetLongPathNameA
BaseFlushAppcompatCache
EnumResourceTypesW
CloseProfileUserMapping
CopyLZFile
ClearCommError
QueryDosDeviceW
TerminateJobObject
CallNamedPipeW
IsDBCSLeadByteEx
msvcp60
?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?round_error@?$numeric_limits@G@std@@SAGXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??Kstd@@YA?AV?$complex@N@0@ABV10@ABN@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?is_open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QBE_NXZ
??1?$numpunct@G@std@@UAE@XZ
??4?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?lt@?$char_traits@D@std@@SA_NABD0@Z
??9locale@std@@QBE_NABV01@@Z
?polar@std@@YA?AV?$complex@M@1@ABM@Z
??0_Winit@std@@QAE@XZ
_Strcoll
??0domain_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$numpunct@G@std@@QAE@I@Z
??0logic_error@std@@QAE@ABV01@@Z
?quiet_NaN@?$numeric_limits@D@std@@SADXZ
?neg_format@?$_Mpunct@G@std@@QBE?AUpattern@money_base@2@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?quiet_NaN@?$numeric_limits@K@std@@SAKXZ
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??_7?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??9std@@YA_NABV?$complex@M@0@0@Z
?id@?$moneypunct@G$00@std@@2V0locale@2@A
?cosh@std@@YA?AV?$complex@O@1@ABV21@@Z
user32
GetProgmanWindow
SetWindowsHookExW
TranslateMessage
WindowFromDC
IsCharUpperA
MessageBoxExA
LoadRemoteFonts
SetWindowTextW
EqualRect
PaintDesktop
GetFocus
DdeInitializeA
TileChildWindows
GetPropA
GetClipboardSequenceNumber
UserRegisterWowHandlers
DlgDirListComboBoxA
GetCapture
SetDoubleClickTime
WaitForInputIdle
GetClassInfoExA
LoadLocalFonts
DlgDirSelectComboBoxExW
SetWinEventHook
IsWindowInDestroy
SetRectEmpty
DrawCaptionTempW
GetSysColorBrush
DragObject
userenv
RsopSetPolicySettingStatus
GetDefaultUserProfileDirectoryA
GetUserProfileDirectoryA
DeleteProfileW
RsopAccessCheckByType
GetPreviousFgPolicyRefreshInfo
LeaveCriticalPolicySection
DeleteProfileA
DllCanUnloadNow
RefreshPolicyEx
DestroyEnvironmentBlock
GetAppliedGPOListA
GetProfilesDirectoryA
GetAppliedGPOListW
DllGetClassObject
GetAllUsersProfileDirectoryA
GetAllUsersProfileDirectoryW
RsopLoggingEnabled
LoadUserProfileA
WaitForUserPolicyForegroundProcessing
GetProfilesDirectoryW
ExpandEnvironmentStringsForUserW
GetGPOListW
DllUnregisterServer
query
?RefreshParams@CWorkQueue@@QAEXKK@Z
??1CSdidLookupTable@@QAE@XZ
??1CFilterDaemon@@QAE@XZ
?SkipDouble@CMemDeSerStream@@UAEXXZ
?PutValue@CValueNormalizer@@QAEXKAAKABVCStorageVariant@@@Z
??0CFileBuffer@@QAE@AAVCFileMapView@@I@Z
?My_wcstoui64@@YA_KPBGPAPAGH@Z
?GetDWORDParam@CCatalogAdmin@@QAEHPBGAAK@Z
?Marshall@CDbPropSet@@QBEXAAVPSerStream@@@Z
?UnMarshall@CRestriction@@SGPAV1@AAVPDeSerStream@@@Z
LoadBinaryFilter
?Read@CRcovStrmTrans@@QAEKPAXK@Z
?PidToRealPid@CPidMapper@@QAEKK@Z
CITextToFullTree
?Remove@CSort@@QAEXI@Z
CIGetGlobalPropertyList
?SkipGUID@CMemDeSerStream@@UAEXXZ
?Release@CEmptyPropertyList@@UAGKXZ
??0CStandardPropMapper@@QAE@XZ
?GetPropInfoFromName@CEmptyPropertyList@@UAGJPBGPAPAUtagDBID@@PAGPAI@Z
?Copy@CDbPropSet@@QAEHABUtagDBPROPSET@@@Z
??0CCiAdminParams@@QAE@PAVCLangList@@@Z
?IsNullPointerVariant@@YGHPAUtagPROPVARIANT@@@Z
?Shrink@CDynStream@@QAEXAAVPStorage@@K@Z
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ