Static task
static1
Behavioral task
behavioral1
Sample
55d579d13fc4275743d02d9a69eb8b95_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
55d579d13fc4275743d02d9a69eb8b95_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
55d579d13fc4275743d02d9a69eb8b95_JaffaCakes118
-
Size
866KB
-
MD5
55d579d13fc4275743d02d9a69eb8b95
-
SHA1
29083332843afc8a2e30ff24dd449ec3a21ff4e8
-
SHA256
ad3297a9ab84b439a91267e23600b0487dd698aeae65a0983cb400962a8c3692
-
SHA512
731f8c229a89dd596d7544fad142a5225a819e4e7cd90476919ba413b736c896a8ce9778d0f78701f750db261221a8b51761d5bf9e3f119c1b366b82f9137c01
-
SSDEEP
24576:k6U63p5GfnI00lrCy+n1FXFZgM4oiucDZqYn:kv63XGfnI0krX+1v6oiuAIYn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 55d579d13fc4275743d02d9a69eb8b95_JaffaCakes118
Files
-
55d579d13fc4275743d02d9a69eb8b95_JaffaCakes118.exe windows:5 windows x86 arch:x86
5643d064cbfe52f391ac0b69a38ccf7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp60
?_Doraise@underflow_error@std@@MBEXXZ
?do_pos_format@?$_Mpunct@D@std@@MBE?AUpattern@money_base@2@XZ
??4?$numeric_limits@_N@std@@QAEAAV01@ABV01@@Z
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0locale@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@N@0@@Z
??_7?$messages@D@std@@6B@
?do_toupper@?$ctype@G@std@@MBEPBGPAGPBG@Z
?max@?$numeric_limits@G@std@@SAGXZ
_LSinh
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?do_close@?$messages@G@std@@MBEXH@Z
??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_N@Z
??1time_base@std@@UAE@XZ
?ws@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
??1?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
??1domain_error@std@@UAE@XZ
?toupper@?$ctype@D@std@@QBEDD@Z
?denorm_min@?$numeric_limits@J@std@@SAJXZ
?quiet_NaN@?$numeric_limits@F@std@@SAFXZ
?close@?$messages@G@std@@QBEXH@Z
?do_grouping@?$numpunct@G@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_F?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ
?max@?$numeric_limits@D@std@@SADXZ
?_Getcat@?$moneypunct@G$00@std@@SAIXZ
??4?$_Complex_base@O@std@@QAEAAV01@ABV01@@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAF@Z
?toupper@?$ctype@G@std@@QBEGG@Z
_Strcoll
_Rteps
?signaling_NaN@?$numeric_limits@K@std@@SAKXZ
?epsilon@?$numeric_limits@M@std@@SAMXZ
??Gstd@@YA?AV?$complex@N@0@ABNABV10@@Z
?ldexp@?$_Ctr@O@std@@SAOOH@Z
??_7?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
lz32
GetExpandedNameA
LZOpenFileW
LZDone
LZClose
LZSeek
LZInit
LZOpenFileA
LZCopy
LZRead
CopyLZFile
GetExpandedNameW
LZStart
LZCloseFile
LZCreateFileW
iphlpapi
InternalGetIpAddrTable
GetUdpStatisticsEx
register_icmp
GetIpStatisticsEx
IcmpCloseHandle
InternalSetTcpEntry
_PfDeleteLog@0
InternalSetIpNetEntry
DeleteIpNetEntry
CreateIpNetEntry
InternalSetIpForwardEntry
UnenableRouter
AllocateAndGetIpAddrTableFromStack
_PfBindInterfaceToIndex@16
_PfMakeLog@4
GetUdpTable
GetFriendlyIfIndex
InternalGetIpNetTable
GetIpForwardTable
do_echo_rep
NotifyRouteChange
_PfRebindFilters@8
InternalGetIpForwardTable
_PfTestPacket@20
_PfAddFiltersToInterface@24
FlushIpNetTable
advapi32
EnumDependentServicesW
SystemFunction024
EnumerateTraceGuids
LsaSetSecurityObject
CryptEnumProvidersA
LsaDeleteTrustedDomain
SystemFunction016
WmiQuerySingleInstanceMultipleW
IsTokenRestricted
SetSecurityDescriptorOwner
MD4Init
GetSidLengthRequired
OpenProcessToken
DecryptFileW
SetUserFileEncryptionKey
RegSetKeySecurity
WmiQuerySingleInstanceA
GetTrusteeFormW
GetAccessPermissionsForObjectW
GetSecurityInfo
SystemFunction034
ControlTraceA
FreeInheritedFromArray
InstallApplication
LsaLookupSids
SetEntriesInAclW
RegEnumValueA
CredReadDomainCredentialsA
OpenSCManagerA
CryptEnumProviderTypesA
SaferComputeTokenFromLevel
RegOpenKeyW
AddAccessAllowedObjectAce
UnregisterIdleTask
MakeSelfRelativeSD
ElfDeregisterEventSource
kernel32
LCMapStringW
ReleaseMutex
VerifyVersionInfoW
AddConsoleAliasA
SetUserGeoID
UnlockFileEx
EndUpdateResourceW
SetConsoleCtrlHandler
IsValidLocale
GetUserDefaultLCID
OpenThread
LoadLibraryExW
GetThreadLocale
SetConsoleNumberOfCommandsA
GetUserGeoID
Heap32Next
SetLocalPrimaryComputerNameA
WritePrivateProfileStructW
GetTempFileNameA
SetMailslotInfo
UTRegister
GetCPInfoExA
GetNumaHighestNodeNumber
RaiseException
FindNextFileA
VirtualAlloc
CompareFileTime
InterlockedDecrement
ReadConsoleOutputA
IsValidCodePage
LoadLibraryA
EnterCriticalSection
IsDebuggerPresent
LCMapStringA
VerLanguageNameW
FindNextVolumeW
VirtualAllocEx
LeaveCriticalSection
Module32Next
ExpungeConsoleCommandHistoryA
GetSystemDefaultLCID
RestoreLastError
GetSystemDefaultLangID
GlobalAddAtomW
msvcrt
exit
__p__commode
__getmainargs
__set_app_type
Sections
.text Size: 187KB - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 510KB - Virtual size: 510KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 165KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ