Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_63887f8c3d927bd896f4871168ea2539.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_63887f8c3d927bd896f4871168ea2539.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_63887f8c3d927bd896f4871168ea2539
-
Size
868KB
-
MD5
63887f8c3d927bd896f4871168ea2539
-
SHA1
6ffdd8cce0242a2514fdcbab35e2aaf04d1a7cc7
-
SHA256
252bae86c6911ff67073f491a4aa8785171d7d1dcd1258895922dc6c126ae1e3
-
SHA512
395de786a5182b5bcb38438f517bca9b652356767da1ee552cb0870231a4e08d15c73d93dded8d4993d806cabea39f35bc78cb56cf5f0fe0c4fc35ff2d0b8972
-
SSDEEP
12288:0xirkH0VCPf7cR8l7DPv6jd7Flej+Z4Ne0WHBF/HMe8fJGS2q3EuUdST5LgaX:sirkC2fIR8tklFY1UBF/HMQq31z5LgG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_63887f8c3d927bd896f4871168ea2539
Files
-
JaffaCakes118_63887f8c3d927bd896f4871168ea2539.exe windows:5 windows x86 arch:x86
42993600b647212127b3375c1cb6894b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_lock
__toascii
_wsopen
strcoll
_mkdir
_wfsopen
_fpieee_flt
system
_ui64toa
iswpunct
_wfindnext
??4__non_rtti_object@@QAEAAV0@ABV0@@Z
_getdrive
isleadbyte
_wexecvpe
_ungetwch
_findnexti64
_i64toa
__p__fileinfo
_CIasin
_strerror
__p___winitenv
wcsspn
_fcloseall
_mbsnbcnt
_wexeclp
__mb_cur_max
__CxxCallUnwindDtor
_cgets
_timezone
_strset
_execvpe
_ftol
_putch
_jn
wcscmp
_chkesp
_cwscanf
vfprintf
_cscanf
??_V@YAXPAX@Z
__pioinfo
__DestructExceptionObject
gdi32
RemoveFontResourceA
GdiSetLastError
CreateColorSpaceA
GetRasterizerCaps
CreateDCW
SetWindowExtEx
CreateSolidBrush
CreateMetaFileW
CreateFontIndirectExA
DdEntry44
GetFontData
GetCharABCWidthsI
DdEntry23
PtVisible
GetEUDCTimeStamp
GetTextExtentExPointW
EngLoadModule
DdEntry43
CreateDCA
GdiStartDocEMF
GdiConvertPalette
EngGetPrinterDataFileName
DdEntry31
PathToRegion
EngQueryLocalTime
EngCreatePalette
EngCreateBitmap
GetBitmapAttributes
EngAcquireSemaphore
DdEntry19
GetLayout
CreateBrushIndirect
GetStringBitmapW
FONTOBJ_pvTrueTypeFontFile
GetCharABCWidthsFloatW
CopyEnhMetaFileA
GetNearestPaletteIndex
InvertRgn
LineTo
AddFontResourceTracking
GetEnhMetaFileDescriptionA
GdiFlush
FONTOBJ_pQueryGlyphAttrs
PlgBlt
msoert2
HrLPSZToBSTR
CchFileTimeToDateTimeW
HrLPSZCPToBSTR
ShellUtil_GetSpecialFolderPath
BrowseForFolder
IUnknownList_CreateInstance
HrStreamSeekSet
AppendTempFileList
HrCopyStream
DeleteTempFile
MessageBoxInst
CleanupGlobalTempFiles
OpenFileStreamWithFlagsW
HrStreamSeekBegin
PszDupA
HrCopyStreamCB
RicheditStreamOut
RicheditStreamIn
HrBSTRToLPSZ
HrIsStreamUnicode
CleanupFileNameInPlaceW
IDrawText
DeleteTempFileOnShutdownEx
fGetBrowserUrlEncoding
HrGetStyleSheet
HrIndexOfMonth
PszScanToWhiteA
IVoidPtrList_CreateInstance
PszDupW
PszScanToCharA
UpdateRebarBandColors
UlStripWhitespaceW
CryptFreeFunc
HrCopyStreamToByte
HrCreatePhonebookEntry
HrSetDirtyFlagImpl
HrIStreamWToBSTR
mapi32
OpenTnefStream@28
ChangeIdleRoutine@28
MAPILogon
cmc_send_documents
GetTnefStreamCodepage
WrapProgress@20
OpenTnefStreamEx
ScUNCFromLocalPath@12
OpenIMsgSession@12
FreePadrlist@4
DeinitMapiUtil@0
cmc_query_configuration
MAPIReadMail
MAPIInitIdle@4
cmc_act_on
FtAddFt@16
HrDecomposeMsgID@24
ScCopyNotifications@16
CreateTable@36
FtSubFt@16
CloseIMsgSession@4
LPropCompareProp@8
FBadRglpNameID@8
HrIStorageFromStream@16
cmc_logoff
OpenStreamOnFile@24
EnableIdleRoutine@8
BMAPIAddress
ScCountProps@12
HrAddColumnsEx@20
BMAPIGetAddress
SzFindLastCh@8
MNLS_lstrcpyW@8
MAPILogoff
BMAPIGetReadMail
OpenStreamOnFile
FPropCompareProp@12
msvcrt40
??0istream_withassign@@QAE@PAVstreambuf@@@Z
memchr
_controlfp
mblen
__p__fmode
_getcwd
_ismbbalnum
mbtowc
??_Gios@@UAEPAXI@Z
fflush
_cabs
_wfsopen
_except_handler2
?hex@@YAAAVios@@AAV1@@Z
_nextafter
_execlp
__RTDynamicCast
?x_lockc@ios@@0U_CRT_CRITICAL_SECTION@@A
log10
??4ios@@IAEAAV0@ABV0@@Z
_j0
??0ifstream@@QAE@PBDHH@Z
_wsplitpath
??4iostream@@IAEAAV0@PAVstreambuf@@@Z
strtod
??_Eistrstream@@UAEPAXI@Z
?binary@filebuf@@2HB
kernel32
LZCloseFile
SetLocalPrimaryComputerNameW
IsValidCodePage
VirtualAlloc
RaiseException
DebugSetProcessKillOnExit
GlobalAlloc
GetVersion
LoadLibraryA
_lopen
Module32FirstW
LCMapStringW
HeapWalk
GetConsoleAliasExesLengthA
InitializeCriticalSection
GetProfileSectionA
GetFullPathNameW
ReadConsoleOutputAttribute
GetAtomNameW
GetTapeStatus
GetConsoleHardwareState
WriteConsoleInputVDMW
GlobalFindAtomA
GetCPInfoExW
PulseEvent
FindNextFileW
GetCommModemStatus
SetProcessShutdownParameters
IsValidLocale
RtlMoveMemory
SearchPathW
GetModuleHandleA
SetConsoleOutputCP
GetPrivateProfileSectionA
CreateThread
GetPrivateProfileIntA
GetFileAttributesExA
GetThreadContext
DefineDosDeviceA
Sections
.text Size: 329KB - Virtual size: 329KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 311KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 222KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ