Static task
static1
Behavioral task
behavioral1
Sample
3a4f7f76fcebabfeaee8ac66bcefb96c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3a4f7f76fcebabfeaee8ac66bcefb96c_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3a4f7f76fcebabfeaee8ac66bcefb96c_JaffaCakes118
-
Size
404KB
-
MD5
3a4f7f76fcebabfeaee8ac66bcefb96c
-
SHA1
a2587be4953ca5b8a5015d8cc0d45ea911152c7e
-
SHA256
d769f7862d5805674c2ae246e7f5fd84378395a1b010c09f2327f431eb9f2b4f
-
SHA512
c4867f4552739ba3b3ed270b7ed6f9bf813a2b952424b15abb068a21212152cee90d28f46b96849b81883fde2105eb73dd1ce9ea48acc6e243a17df5b733cc24
-
SSDEEP
6144:ZudwmKYDJG22eZBe9WSGVP4fUeddizgZp6JzyRT7SaG11:eFbvVScA8qEgZY171
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a4f7f76fcebabfeaee8ac66bcefb96c_JaffaCakes118
Files
-
3a4f7f76fcebabfeaee8ac66bcefb96c_JaffaCakes118.exe windows:5 windows x86 arch:x86
dcdec0b195fbd7928808277930b41327
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
msvcrt20
swprintf
__iscsym
strftime
?setmode@ofstream@@QAEHH@Z
_wremove
?osfx@ostream@@QAEXXZ
_access
?endl@@YAAAVostream@@AAV1@@Z
_wutime
free
??5istream@@QAEAAV0@P6AAAVios@@AAV1@@Z@Z
?in_avail@streambuf@@QBEHXZ
??5istream@@QAEAAV0@P6AAAV0@AAV0@@Z@Z
?is_open@ofstream@@QBEHXZ
??1ostrstream@@UAE@XZ
__p__iob
_wchmod
_mbctype
_tcsnset
??_Giostream@@UAEPAXI@Z
??_8istrstream@@7B@
clock
strncpy
kernel32
SetProcessAffinityMask
SetConsoleCursorInfo
GetPrivateProfileStructW
GetTempFileNameW
ExpungeConsoleCommandHistoryA
GetProcAddress
LoadLibraryExW
FileTimeToSystemTime
GetCommandLineA
GetLocaleInfoW
GetModuleHandleW
SetTimerQueueTimer
ExitProcess
SetConsoleNumberOfCommandsA
GetThreadPriority
ReadDirectoryChangesW
GetDiskFreeSpaceA
SetFirmwareEnvironmentVariableA
VirtualAlloc
WriteConsoleOutputA
GetStartupInfoA
AddRefActCtx
HeapCreate
lstrcpyA
FillConsoleOutputCharacterW
GetConsoleAliasesW
GetProcessTimes
LoadLibraryA
GetNumberOfConsoleMouseButtons
GetConsoleHardwareState
EnumSystemLocalesW
CreateProcessInternalW
msvcp60
??_F?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_istream@GU?$char_traits@G@std@@@1@@
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBE@Z
??_7?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
?_Getptr@_Timevec@std@@QBEPAXXZ
?conj@std@@YA?AV?$complex@M@1@ABV21@@Z
?_Getcat@?$moneypunct@G$0A@@std@@SAIXZ
??0domain_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$moneypunct@G$0A@@std@@QAE@I@Z
?_Init@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIABV12@@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??_7?$codecvt@GDH@std@@6B@
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?uncaught_exception@std@@YA_NXZ
?log@std@@YA?AV?$complex@N@1@ABV21@@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAE@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??_7?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
?do_decimal_point@?$numpunct@G@std@@MBEGXZ
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??_7length_error@std@@6B@
??Dstd@@YA?AV?$complex@N@0@ABNABV10@@Z
crtdll
_fsopen
_jn
_ismbblead
_heapwalk
ungetc
_spawnvp
_mbclen
_cexit
_ismbcalpha
_putw
iswupper
fread
labs
wcsspn
_msize
_futime
_creat
_errno
_osversion_dll
_mbsncmp
_mbscat
user32
WaitMessage
DdeUnaccessData
MessageBoxIndirectW
SetParent
BuildReasonArray
GetMessageTime
DdeQueryNextServer
EditWndProc
SetRectEmpty
wvsprintfA
wsprintfA
GetKeyboardState
SendMessageA
DragObject
ChangeDisplaySettingsA
GetClipboardFormatNameW
DdeSetQualityOfService
SetWindowsHookExA
DdeQueryStringW
EnumPropsA
InSendMessage
GetSubMenu
GetRawInputDeviceInfoA
UnregisterMessagePumpHook
PostThreadMessageW
msi
MsiLocateComponentA
MsiOpenDatabaseW
MsiSummaryInfoPersist
MsiCreateAndVerifyInstallerDirectory
MsiGetFileVersionA
MsiDatabaseExportW
DllGetVersion
MsiAdvertiseProductExW
DllCanUnloadNow
MsiGetProductInfoFromScriptW
MsiLocateComponentW
MsiGetShortcutTargetW
MsiIsProductElevatedW
MsiGetSummaryInformationA
MsiGetSourcePathW
MsiProcessAdvertiseScriptA
MsiGetUserInfoW
MsiSetPropertyA
MsiRecordDataSize
MsiEnumRelatedProductsW
MsiQueryFeatureStateFromDescriptorW
MsiGetFeatureValidStatesW
MsiGetFeatureValidStatesA
hhsetup
??0CLocation@@QAE@XZ
?GetNextFolder@CFolder@@QAEPAV1@XZ
?Save@CCollection@@QAEKXZ
?MergeKeywords@CCollection@@QAEHPAD@Z
?GetId@CLocation@@QBEPADXZ
??0CCollection@@QAE@XZ
?FindLocation@CCollection@@QAEPAVCLocation@@PBGPAI@Z
?HandleTitle@CCollection@@AAEKPAVCParseXML@@PAD@Z
?GetMasterCHM@CCollection@@QAEHPAPADPAG@Z
??0CPointerList@@QAE@XZ
??1CLocation@@QAE@XZ
?GetSampleLocationW@CCollection@@QAEPBGXZ
?GetId@CTitle@@QAEPADXZ
?Next@CPointerList@@QAEPAUListItem@@PAU2@@Z
?Add@CPointerList@@QAEPAUListItem@@PAX@Z
?First@CPointerList@@QAEPAUListItem@@XZ
??4CFolder@@QAEAAV0@ABV0@@Z
?AddRef@CCollection@@QAEXXZ
?GetFindMergedCHMS@CCollection@@QAEHXZ
??1CPointerList@@QAE@XZ
?GetRootFolder@CCollection@@QAEPAVCFolder@@XZ
?SetId@CLocation@@QAEXPBD@Z
?GetSampleLocation@CCollection@@QAEPADXZ
?FindLocation@CCollection@@QAEPAVCLocation@@PBDPAI@Z
?DeleteFolder@CCollection@@QAEKPAVCFolder@@@Z
?SetPath@CLocation@@QAEXPBD@Z
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 157KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 139KB - Virtual size: 542KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ