Static task
static1
Behavioral task
behavioral1
Sample
3dc4c3ef31806174ac7a9b6bf726bfd0_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3dc4c3ef31806174ac7a9b6bf726bfd0_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3dc4c3ef31806174ac7a9b6bf726bfd0_JaffaCakes118
-
Size
159KB
-
MD5
3dc4c3ef31806174ac7a9b6bf726bfd0
-
SHA1
0a71cd8245ff32df6e86a1947279d944d290e9f0
-
SHA256
12e08406f716541e7cc149d2009c9f67bb785ab614a4610a086fb82228804ba4
-
SHA512
8edd6356cec946fab85c99cdd69ca0616d08e6dc82d5c13d0b093edc4fd2a155d6f56041edb9784e5bbb03778e0337895ed3482c77fb17842755aa04ddc1343e
-
SSDEEP
3072:/mwsD99D1ZDTvLLNzecmZPk6hx8CFrl6hRtcRcqzEwX5/stwZf2Zl5zrGw1AO:/mwsD99D1RTvL0nByRWzzEwXdmwZf2Z5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3dc4c3ef31806174ac7a9b6bf726bfd0_JaffaCakes118
Files
-
3dc4c3ef31806174ac7a9b6bf726bfd0_JaffaCakes118.exe windows:4 windows x86 arch:x86
9fd49a5fe620462bc1d29d489ca4e164
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryA
GetProcAddress
CreateProcessA
ExitProcess
TerminateProcess
GetTempPathA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetEnvironmentVariableW
GetShortPathNameW
GetModuleFileNameW
LoadLibraryW
CreateFileW
GetSystemDirectoryW
CopyFileA
GetVersionExW
Sleep
GetStartupInfoA
CreateFileA
WriteFile
GetCurrentProcess
GetLastError
CloseHandle
GetModuleHandleA
GetModuleFileNameA
SetProcessPriorityBoost
GetFileAttributesW
advapi32
RegDeleteValueA
RegCloseKey
GetCurrentHwProfileA
RegOpenKeyExA
RegSetValueExA
shell32
ShellExecuteExW
SHChangeNotify
msvcp60
?id@?$ctype@D@std@@2V0locale@2@A
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Incref@facet@locale@std@@QAEXXZ
??1?$ctype@D@std@@UAE@XZ
??0_Lockit@std@@QAE@XZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
??Bid@locale@std@@QAEIXZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_Iscloc@locale@std@@QBE_NXZ
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??1locale@std@@QAE@XZ
??0locale@std@@QAE@XZ
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?do_toupper@?$ctype@D@std@@MBEDD@Z
?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z
?do_tolower@?$ctype@D@std@@MBEDD@Z
?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??_7bad_cast@std@@6B@
??1_Lockit@std@@QAE@XZ
??0?$ctype@D@std@@QAE@PBF_NI@Z
wininet
InternetReadFile
HttpQueryInfoW
HttpOpenRequestW
HttpSendRequestW
InternetConnectW
InternetCloseHandle
InternetOpenW
msvcrt
wcscpy
_controlfp
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
free
_CxxThrowException
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
strlen
__CxxFrameHandler
vsprintf
wcslen
wcscat
strcat
??2@YAPAXI@Z
_except_handler3
memset
time
atoi
_wtol
strncpy
rand
tolower
strstr
atof
srand
_XcptFilter
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 139KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE