Static task
static1
Behavioral task
behavioral1
Sample
05850c74b00bb569e3206074206e1af9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
05850c74b00bb569e3206074206e1af9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
05850c74b00bb569e3206074206e1af9_JaffaCakes118
-
Size
88KB
-
MD5
05850c74b00bb569e3206074206e1af9
-
SHA1
79f341bd46fe10a74b78f8b38a35a7f6f0305647
-
SHA256
76021726b528fbb36344563992204de6a6fa96857c5951fcd4087dac7b054ef4
-
SHA512
f4921ac0750e383ce688703925ff03a9808f808df675fce5d339708fd684c686b42c193276b0d6c5b4004b9427ec2c005b8257454a987cc51dafc19cd2061213
-
SSDEEP
1536:3G936t3+7ZKJnte/aaEZidoWebRNo1IbP/+mM:2936t3AYJHZyebkab+mM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05850c74b00bb569e3206074206e1af9_JaffaCakes118
Files
-
05850c74b00bb569e3206074206e1af9_JaffaCakes118.exe windows:4 windows x86 arch:x86
3df3a1e2e7e14d14105004522a77cbda
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetProcAddress
LoadLibraryA
WriteFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetTickCount
FreeLibrary
CreateThread
InitializeCriticalSection
ResumeThread
TlsAlloc
TlsFree
TlsSetValue
GetCurrentThreadId
TlsGetValue
lstrlenA
RaiseException
InterlockedExchange
LocalAlloc
CreateMutexA
SetEvent
SetUnhandledExceptionFilter
CreateEventA
WaitForSingleObject
CloseHandle
AllocConsole
GetStdHandle
GlobalAlloc
GlobalFree
FormatMessageA
LocalFree
SetConsoleCtrlHandler
GetModuleHandleA
GetCurrentProcess
TerminateProcess
GetModuleFileNameA
SetFilePointer
ReadFile
GetLastError
lstrcpynA
MultiByteToWideChar
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
Sleep
GetLocalTime
GetVersionExA
GetSystemDirectoryA
ExpandEnvironmentStringsA
DeleteFileA
CreateFileA
GetFileSize
SuspendThread
GetStartupInfoA
user32
PeekMessageA
PostThreadMessageA
GetMessageA
TranslateMessage
DispatchMessageA
RegisterClassA
CreateWindowExA
PostQuitMessage
DefWindowProcA
advapi32
RegEnumValueA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceA
RegCreateKeyA
RegDeleteValueA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
StartServiceCtrlDispatcherA
GetUserNameA
LookupAccountNameA
IsValidSid
GetLengthSid
CopySid
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegDeleteKeyA
oleaut32
SysStringLen
SysAllocString
SysFreeString
crypt32
CertAddEncodedCertificateToStore
CertOpenStore
CertCloseStore
msvcp60
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
msvcrt
_fdopen
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__CxxFrameHandler
_purecall
strlen
??2@YAPAXI@Z
memset
strerror
_errno
sprintf
_CxxThrowException
toupper
strstr
isxdigit
strncmp
strcmp
printf
strcpy
_mbslen
_mbscmp
strcat
setvbuf
_acmdln
_open_osfhandle
_iob
__p___argv
__p___argc
_snprintf
_vsnprintf
isdigit
atol
free
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_controlfp
Sections
.text Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ