Static task
static1
Behavioral task
behavioral1
Sample
28e96e8285c0f3ae122815fac3efebbf_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
28e96e8285c0f3ae122815fac3efebbf_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
28e96e8285c0f3ae122815fac3efebbf_JaffaCakes118
-
Size
342KB
-
MD5
28e96e8285c0f3ae122815fac3efebbf
-
SHA1
100cf35d0bacdc8ef7e3d615402b6c1c949ff9f9
-
SHA256
d1db148d63ca220aeb0adca39ca745323f06824847aa5b674b15fedcac38c02c
-
SHA512
f791db68f6bc2557000b946a153214a776fa45b73729c615af178d4de103b64944bff483269bb61ee2fb136df5541e70a9b358d010f9c0f793b12a33d7327b63
-
SSDEEP
6144:tBxVntTrnh8QgZUfq+dKV99FYCCItdZqDLYAFJs6ojFHdO5pt:tptTrnEWVGnFhXtTqDLYQs6oZHdON
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28e96e8285c0f3ae122815fac3efebbf_JaffaCakes118
Files
-
28e96e8285c0f3ae122815fac3efebbf_JaffaCakes118.exe windows:5 windows x86 arch:x86
fe883ad8e52149b4dc4b4f89ee92762b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
msdart
?SetDefaultSpinCount@CFakeLock@@SGXG@Z
?sm_pfnSetCriticalSectionSpinCount@CCriticalSection@@0P6GKPAU_RTL_CRITICAL_SECTION@@K@ZA
?sm_wDefaultSpinCount@CSpinLock@@1GA
?WriteUnlock@CFakeLock@@QAEXXZ
?IsLocked@CLockedSingleList@@QBE_NXZ
?IsWriteLocked@CReaderWriterLock2@@QBE_NXZ
?GetDefaultSpinCount@CReaderWriterLock3@@SGGXZ
?_RemoveThisFromGlobalList@CLKRHashTable@@AAEXXZ
?_BucketAddress@CLKRLinearHashTable@@ABEKK@Z
??0CLockedDoubleList@@QAE@XZ
?WriteLock@CReaderWriterLock2@@QAEXXZ
?_LockSpin@CSmallSpinLock@@AAEXXZ
?sm_llGlobalList@CLKRHashTable@@0VCLockedDoubleList@@A
??4CCritSec@@QAEAAV0@ABV0@@Z
?_RemoveThisFromGlobalList@CLKRLinearHashTable@@AAEXXZ
??0CFakeLock@@QAE@XZ
??4CSmallSpinLock@@QAEAAV0@ABV0@@Z
?SetSpinCount@CReaderWriterLock2@@QAE_NG@Z
?IsWriteUnlocked@CReaderWriterLock@@QBE_NXZ
?DeleteRecord@CLKRHashTable@@QAE?AW4LK_RETCODE@@PBX@Z
?FindRecord@CLKRLinearHashTable@@QBE?AW4LK_RETCODE@@PBX@Z
?ReadUnlock@CLKRLinearHashTable@@QBEXXZ
oledlg
OleUICanConvertOrActivateAs
OleUIAddVerbMenuW
OleUIObjectPropertiesW
OleUIChangeIconW
OleUIPromptUserA
OleUIConvertA
OleUIInsertObjectA
OleUIInsertObjectW
OleUIChangeSourceA
OleUIUpdateLinksA
OleUIUpdateLinksW
OleUIChangeIconA
OleUIObjectPropertiesA
OleUIAddVerbMenuA
OleUIEditLinksW
OleUIEditLinksA
OleUIBusyW
OleUIConvertW
OleUIPromptUserW
OleUIChangeSourceW
OleUIPasteSpecialW
OleUIBusyA
kernel32
CreateFileMappingA
SetComputerNameExW
GlobalFindAtomA
LZCreateFileW
SetLocalPrimaryComputerNameA
DosDateTimeToFileTime
GetTickCount
SizeofResource
SetProcessAffinityMask
GetCurrentThreadId
VirtualAlloc
GetCurrentProcessId
GetStartupInfoW
ReleaseMutex
GetModuleHandleW
ExitVDM
GetConsoleHardwareState
LoadLibraryA
GetVDMCurrentDirectories
DebugBreak
GetCPInfoExA
DeleteTimerQueueTimer
WriteFileGather
Process32FirstW
OpenJobObjectA
EnumDateFormatsW
GetProfileIntA
QueryPerformanceCounter
GetConsoleInputWaitHandle
msvcrt40
_wcmdln
_ismbblead
??0istrstream@@QAE@PADH@Z
?pbackfail@streambuf@@UAEHH@Z
_wunlink
??4istream_withassign@@QAEAAVistream@@ABV1@@Z
?rdstate@ios@@QBEHXZ
?tellp@ostream@@QAEJXZ
ldiv
_adj_fdiv_m32i
?sputc@streambuf@@QAEHH@Z
?write@ostream@@QAEAAV1@PBEH@Z
??_8ostream_withassign@@7B@
strtoul
?unlockc@ios@@KAXXZ
??3@YAXPAX@Z
__p__wcmdln
_lseek
_mbsrchr
_lrotr
__p__fmode
_strdate
setupapi
SetupLogErrorW
SetupSetSourceListA
CM_Get_Log_Conf_Priority_Ex
SetupBackupErrorA
CM_Set_DevNode_Registry_PropertyW
SetupUninstallOEMInfW
SetupInstallServicesFromInfSectionA
CM_Connect_MachineA
SetupDiGetHwProfileFriendlyNameA
SetupFindNextMatchLineW
SetupDiGetClassDevPropertySheetsW
CM_Locate_DevNodeW
CM_Get_HW_Prof_Flags_ExA
pSetupOpenAndMapFileForRead
SetupAddToSourceListA
SetupDiSetSelectedDriverA
CM_Get_Sibling
SetupRemoveFromSourceListA
CM_Add_Range
CM_Locate_DevNodeA
SetupAddToDiskSpaceListA
SetupQueueDeleteSectionW
SetupCloseFileQueue
CM_Get_Device_IDW
SetupFindFirstLineA
CMP_WaitNoPendingInstallEvents
CM_Query_Remove_SubTree
rpcrt4
NdrServerContextNewMarshall
NdrNsGetBuffer
NdrVaryingArrayMarshall
CStdStubBuffer_Connect
NdrAllocate
NdrFullPointerFree
NdrpReleaseTypeGenCookie
RpcNsBindingInqEntryNameW
RpcServerUseProtseqIfExA
data_into_ndr
RpcBindingInqAuthClientExW
RpcIfIdVectorFree
NdrTypeFlags
NdrSendReceive
RpcBindingFree
MesEncodeDynBufferHandleCreate
pfnUnmarshallRoutines
SimpleTypeBufferSize
RpcMgmtEpEltInqBegin
I_RpcLogEvent
NdrMapCommAndFaultStatus
RpcBindingSetAuthInfoExW
I_RpcBindingToStaticStringBindingW
msvcirt
??6ostream@@QAEAAV0@I@Z
?setmode@ofstream@@QAEHH@Z
?eof@ios@@QBEHXZ
??4istream@@IAEAAV0@PAVstreambuf@@@Z
??_Dofstream@@QAEXXZ
?fail@ios@@QBEHXZ
??0fstream@@QAE@ABV0@@Z
?overflow@stdiobuf@@UAEHH@Z
?fd@filebuf@@QBEHXZ
?str@istrstream@@QAEPADXZ
??_Gexception@@UAEPAXI@Z
??1ostrstream@@UAE@XZ
??_Gostream@@UAEPAXI@Z
?setrwbuf@stdiobuf@@QAEHHH@Z
?is_open@ofstream@@QBEHXZ
??1Iostream_init@@QAE@XZ
??_Eistream_withassign@@UAEPAXI@Z
??_8istrstream@@7B@
?open@filebuf@@QAEPAV1@PBDHH@Z
??_Gostrstream@@UAEPAXI@Z
??0ofstream@@QAE@HPADH@Z
??_7stdiobuf@@6B@
_mtlock
msvcp60
??0?$moneypunct@D$00@std@@QAE@ABV_Locinfo@1@I@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?denorm_min@?$numeric_limits@G@std@@SAGXZ
??_0?$_Complex_base@N@std@@QAEAAV01@ABN@Z
??1range_error@std@@UAE@XZ
??4?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4_Num_float_base@std@@QAEAAU01@ABU01@@Z
??4?$numeric_limits@M@std@@QAEAAV01@ABV01@@Z
??Ystd@@YAAAV?$complex@M@0@AAV10@ABV10@@Z
??0?$complex@N@std@@QAE@ABV?$complex@O@1@@Z
??1bad_typeid@std@@UAE@XZ
?open@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXPBDH@Z
?_Init@?$messages@D@std@@IAEXABV_Locinfo@2@@Z
??Pstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?denorm_min@?$numeric_limits@O@std@@SAOXZ
?real@?$_Complex_base@N@std@@QBENXZ
?copy@?$char_traits@G@std@@SAPAGPAGPBGI@Z
??1_Locinfo@std@@QAE@XZ
?do_toupper@?$ctype@G@std@@MBEGG@Z
?_Isinf@?$_Ctr@O@std@@SA_NO@Z
_LPoly
?imag@std@@YAOABV?$complex@O@1@@Z
?imag@?$_Complex_base@N@std@@QBENXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXF@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?_Cosh@?$_Ctr@M@std@@SAMMM@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 237KB - Virtual size: 645KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ