Static task
static1
Behavioral task
behavioral1
Sample
fcafbcf2a78c7a2007083eda20d07368_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fcafbcf2a78c7a2007083eda20d07368_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fcafbcf2a78c7a2007083eda20d07368_JaffaCakes118
-
Size
85KB
-
MD5
fcafbcf2a78c7a2007083eda20d07368
-
SHA1
8d37a23450ba57700fd636102fbcb4668d1ebf55
-
SHA256
462ba1d05cb71a4d3101545a36bc1d4c2ba870264f20c83a604648670853414c
-
SHA512
6d2f62bf2b8ff355e010b9726d4c77694c0a35ade67d6c6335f27338384b53ba83f9006f7f6b0249e342458e65e4726f94e72f5c93a1679358993d00c3a69f73
-
SSDEEP
1536:4T61APj0aiGEb0kvZbS7wQaY3y6JVoagfabbG+vKB2iAf3PXKtXbFsTotBc8hPRY:4T6laiGEToUbY35JClSbbG+vKIiWiCTL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fcafbcf2a78c7a2007083eda20d07368_JaffaCakes118
Files
-
fcafbcf2a78c7a2007083eda20d07368_JaffaCakes118.exe windows:5 windows x86 arch:x86
b589b4ac9bfff24b299370ae2f68fcd3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
odbcconf
QueryApplication
UnregisterApplication
SetActionLogMode
DllCanUnloadNow
DllUnregisterServer
SetSilent
AppRegEnum
RegisterApplication
OpenAppRegEnum
SetActionEnum
SetActionLogModeSz
SetActionName
RunDLL32_UnregisterApplication
DllGetClassObject
RunDLL32_RegisterApplication
RefreshAppRegEnum
SetActionLogFile
ExecuteAction
CloseAppRegEnum
DllRegisterServer
msvcp60
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$messages@G@std@@QAE@I@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z
?_Doraise@runtime_error@std@@MBEXXZ
?uflow@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?seekpos@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?length@?$char_traits@D@std@@SAIPBD@Z
?copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPAGII@Z
??Bid@locale@std@@QAEIXZ
?_Callfns@ios_base@std@@AAEXW4event@12@@Z
?assign@?$char_traits@D@std@@SAPADPADIABD@Z
??_7?$basic_ostream@GU?$char_traits@G@std@@@std@@6B@
??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBEHXZ
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBG@Z
?min@?$numeric_limits@D@std@@SADXZ
?toupper@?$ctype@G@std@@QBEGG@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAI@Z
??Ostd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Getcat@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIXZ
??_F?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?signaling_NaN@?$numeric_limits@J@std@@SAJXZ
?endl@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@AAV21@@Z
??_D?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ
ntdll
NtSecureConnectPort
ZwOpenProcessToken
RtlSetCriticalSectionSpinCount
RtlDeregisterWaitEx
DbgUiGetThreadDebugObject
DbgPrompt
NtQueryDebugFilterState
NtRequestPort
ZwQueryInformationProcess
RtlSetTimer
ZwOpenSection
RtlInsertElementGenericTableAvl
kernel32
GetTickCount
CreateDirectoryExW
IsBadStringPtrA
SetCommConfig
GlobalDeleteAtom
LoadLibraryA
VirtualAlloc
HeapCreate
CreateJobObjectW
GetCurrentThreadId
QueryPerformanceCounter
InterlockedFlushSList
GetSystemTimeAsFileTime
GetLastError
SetConsoleIcon
lstrcpyW
SetConsoleKeyShortcuts
Module32First
GetStartupInfoA
GetCurrentProcessId
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ