Static task
static1
Behavioral task
behavioral1
Sample
0b577e0c8bac9b2dec0b2882d939d1fa_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b577e0c8bac9b2dec0b2882d939d1fa_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0b577e0c8bac9b2dec0b2882d939d1fa_JaffaCakes118
-
Size
62KB
-
MD5
0b577e0c8bac9b2dec0b2882d939d1fa
-
SHA1
a00d89e3acd191c68b3edc9aacd9518cb7ae092a
-
SHA256
5286d79c15ad1ce9ef751723e51dfca3a58b1b1d4f86521052235591407be9a4
-
SHA512
ca6d7e606f32a8f3faa1644f9e884b9a04cf8bff00d9a43a84ae235b02770bc4da58e53156b413e1aaeed8c378b6be28c178f357eb4ad2e1281d81102549fc8c
-
SSDEEP
1536:qfVoDPkDxXUo4d/JBiWFAErr0f/taym5Zd+H6d7psk7mUP:lW2jiurrqtaymrHj97X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b577e0c8bac9b2dec0b2882d939d1fa_JaffaCakes118
Files
-
0b577e0c8bac9b2dec0b2882d939d1fa_JaffaCakes118.exe windows:5 windows x86 arch:x86
76ef1b969d5cabbc62cf2f47d0a00690
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
odbc32
SQLColAttributesW
SQLConnect
SQLBrowseConnect
SQLStatistics
SQLCopyDesc
CursorLibLockDesc
SQLDrivers
SQLConnectW
SQLNativeSqlW
SQLMoreResults
SQLGetDiagField
SQLCancel
SQLGetTypeInfoW
SQLColumnPrivileges
SQLFreeConnect
SQLSetConnectAttrA
SQLDriversW
SQLPrimaryKeys
SQLSetConnectOptionW
SQLNumParams
SQLColAttributeA
SQLProceduresA
SQLSetDescField
SQLDriverConnectA
SQLDescribeColA
SQLNativeSql
expsrv
__vbaVarCmpLe
__vbaLateIdNamedCallSt
__vbaLateIdCallSt
__vbaPrintFile
__vbaHresultCheckObj
__vbaNextEachCollAd
__vbaFreeStr
SetMemNewObj
rtcSetTimeBstr
rtcDateFromVar
__vbaEnd
__vbaR8FixI2
__vbaUI1Cy
__vbaExitEachColl
rtcGetDateValue
_adj_fprem
__vbaDateVar
__vbaLateMemNamedCall
rtcGetMinuteOfHour
rtcGetMonthOfYear
__vbaEraseKeepData
__vbaLateMemNamedCallSt
__vbaStrCopy
__vbaFPFix
__vbaR4Cy
rtcGetDayOfMonth
__vbaLateIdSt
icm32
CMTranslateRGBsExt
CMCreateProfile
CMTranslateColors
CMCreateProfileW
CMCheckColors
CMGetInfo
CMGetNamedProfileInfo
CMIsProfileValid
CMCheckRGBs
CMCreateMultiProfileTransform
CMConvertColorNameToIndex
CMCreateTransform
CMTranslateRGBs
CMCheckColorsInGamut
CMCreateTransformW
CMConvertIndexToColorName
CMDeleteTransform
CMCreateTransformExtW
CMTranslateRGB
CMCreateTransformExt
CMCreateDeviceLinkProfile
msvcrt
fwscanf
_beginthreadex
rename
_spawnlpe
_ismbbalnum
??0bad_cast@@QAE@PBD@Z
floor
_wcsrev
__CxxCallUnwindDtor
_futime64
_sopen
strcpy
_lrotr
??_7bad_typeid@@6B@
_nextafter
_heapused
puts
atexit
iswcntrl
__p__acmdln
free
_wspawnvp
_loaddll
kernel32
DebugBreak
OpenWaitableTimerA
GetSystemWindowsDirectoryW
RtlUnwind
LoadLibraryW
OutputDebugStringW
LZInit
SetupComm
GetCommProperties
GetModuleHandleW
ResetWriteWatch
SearchPathW
LoadLibraryA
RemoveDirectoryA
GetCommMask
GetTickCount
GetCurrentProcessId
UnregisterWaitEx
GetProcAddress
GetStartupInfoW
WritePrivateProfileSectionA
QueryPerformanceCounter
VirtualAlloc
GetPrivateProfileSectionA
ReadProcessMemory
LeaveCriticalSection
CreateConsoleScreenBuffer
FlushConsoleInputBuffer
IsValidLanguageGroup
SetProcessWorkingSetSize
EnumSystemCodePagesW
ProcessIdToSessionId
RemoveVectoredExceptionHandler
LocalShrink
GetCurrentThreadId
OpenEventA
AllocateUserPhysicalPages
clusapi
MoveClusterGroup
ClusterResourceCloseEnum
CreateClusterResource
ClusterOpenEnum
ClusterNodeOpenEnum
DeleteClusterResourceType
SetClusterGroupNodeList
ClusterNetworkEnum
GetClusterNetworkKey
RemoveClusterResourceDependency
GetClusterFromGroup
ClusterRegGetKeySecurity
GetClusterKey
EvictClusterNode
CloseCluster
GetNodeClusterState
ClusterResourceEnum
GetClusterNodeId
GetClusterResourceState
RestoreClusterDatabase
ClusterResourceOpenEnum
ClusterNetworkCloseEnum
SetClusterNetworkName
GetClusterFromNetInterface
CloseClusterNotifyPort
ClusterNetworkGetEnumCount
DeleteClusterResource
ClusterResourceTypeOpenEnum
CreateClusterGroup
GetClusterNotify
shell32
SHGetMalloc
mmcbase
??7SC@mmcerror@@QBEHXZ
?MMCErrorBox@@YGHPBGI@Z
??4SC@mmcerror@@QAEAAV01@J@Z
?SetMainThreadID@SC@mmcerror@@SGXK@Z
?s_dwMainThreadID@SC@mmcerror@@0KA
??0CEventBuffer@@QAE@XZ
?MMCErrorBox@@YGHIVSC@mmcerror@@I@Z
?s_hInst@SC@mmcerror@@0PAUHINSTANCE__@@A
?GetFacility@SC@mmcerror@@ABE?AW4facility_type@12@XZ
?FormatErrorString@@YGXPBGVSC@mmcerror@@IPAGH@Z
?GetMainThreadID@SC@mmcerror@@SGKXZ
??1CEventBuffer@@QAE@XZ
?ScFlushPostponed@CEventBuffer@@AAE?AVSC@mmcerror@@XZ
?InternalRelease@CMMCStrongReferences@@AAEKXZ
??_FSC@mmcerror@@QAEXXZ
?MMCErrorBox@@YGHPBGVSC@mmcerror@@I@Z
?GetHelpFile@SC@mmcerror@@SGPBGXZ
?GetCode@SC@mmcerror@@QBEJXZ
?Trace_@SC@mmcerror@@QBEXXZ
?FromLastError@SC@mmcerror@@QAEAAV12@XZ
??8SC@mmcerror@@QBE_NJ@Z
user32
MessageBoxW
EndDialog
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ