Static task
static1
Behavioral task
behavioral1
Sample
f308d2ab871323e4dfc75cdeeb1e218d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f308d2ab871323e4dfc75cdeeb1e218d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f308d2ab871323e4dfc75cdeeb1e218d_JaffaCakes118
-
Size
340KB
-
MD5
f308d2ab871323e4dfc75cdeeb1e218d
-
SHA1
9c914d95b51ff4ac3c5235f858e62d1bdce5fd55
-
SHA256
fb26ebc083105dfb48c7217adc9ce624686d82e7fb89625bb5f5f4831764dc70
-
SHA512
6b5a03c982eb49cadd9a09b4eed0591d3efdef46aa29fc45f1dacfb55ca3e17a0ca70660443369670c23aa0121a2c4052ac83895eb4e7e85d152963df8a7f776
-
SSDEEP
6144:9do2nANYB1R2N5W4ewIQU1EcgEqrCfcyEbXro+O4V/d/Znjb:9Kv21RA7MG8EC0Lbc+Hdd/Znj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f308d2ab871323e4dfc75cdeeb1e218d_JaffaCakes118
Files
-
f308d2ab871323e4dfc75cdeeb1e218d_JaffaCakes118.exe windows:5 windows x86 arch:x86
e6eeba611096acae1ec55db5c14bcbe4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42u
ord4213
ord2570
ord4392
ord3577
ord3605
ole32
ReleaseStgMedium
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
GetHGlobalFromStream
CoTaskMemAlloc
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CoCreateInstance
advapi32
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
InitializeSecurityDescriptor
CopySid
GetLengthSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegDeleteKeyW
RegEnumKeyExW
LsaOpenPolicy
LsaLookupNames
GetSidSubAuthorityCount
GetSidSubAuthority
LsaFreeMemory
LsaOpenAccount
LsaCreateAccount
LsaGetSystemAccessAccount
LsaSetSystemAccessAccount
LsaClose
GetSecurityDescriptorLength
GetSecurityDescriptorControl
AllocateAndInitializeSid
MakeSelfRelativeSD
FreeSid
MapGenericMask
ControlService
StartServiceW
EnumDependentServicesW
ChangeServiceConfigW
QueryServiceStatusEx
RevertToSelf
IsWellKnownSid
RegConnectRegistryW
QueryServiceStatus
GetUserNameW
RegDeleteValueW
EnumServicesStatusW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorDacl
shlwapi
ord437
gdi32
DeleteObject
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj5 Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj50 Size: 512B - Virtual size: 222B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj51 Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj52 Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj53 Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj54 Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj55 Size: 512B - Virtual size: 214B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fhj56 Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fhj57 Size: 512B - Virtual size: 214B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj58 Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fhj59 Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1231 Size: 512B - Virtual size: 214B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.JAKS Size: 512B - Virtual size: 246B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.GAHS Size: 512B - Virtual size: 198B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.HAJS Size: 512B - Virtual size: 458B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.HnJS Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SKALS Size: 512B - Virtual size: 242B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SKAkS Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SfAkS Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ