Static task
static1
Behavioral task
behavioral1
Sample
fee61abfdb0d8ed2cbe963f5c8a0735f_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fee61abfdb0d8ed2cbe963f5c8a0735f_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fee61abfdb0d8ed2cbe963f5c8a0735f_JaffaCakes118
-
Size
174KB
-
MD5
fee61abfdb0d8ed2cbe963f5c8a0735f
-
SHA1
a46a56a525ac9c22496091498fbb5da20f332510
-
SHA256
8af64731a81063227e32807dc7321776dabd9f0442ca891ac2430d7bcee507dd
-
SHA512
1fc2f1df00febbcbdae82d4e0e6feb7ad9e0de2264788790475350ceed00a4aff94ee350c3869bc5839a2d04fe9899d42fe65d24b08fbd0b34f233975d03468d
-
SSDEEP
3072:oGo2sFC18JxiT8WmSPJ9guTmxFhxfEXybGXl2PtwPnP4gVTfH76ywT9fIqoZ/P/s:+RC183OzHRUxHoybG12lw4gRfb6/Tfoe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fee61abfdb0d8ed2cbe963f5c8a0735f_JaffaCakes118
Files
-
fee61abfdb0d8ed2cbe963f5c8a0735f_JaffaCakes118.exe windows:5 windows x86 arch:x86
9aac303131389686ccd566e54d279313
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
NtQuerySystemTime
RtlIdentifierAuthoritySid
RtlInitUnicodeString
RtlSubAuthoritySid
RtlNtStatusToDosError
RtlSubAuthorityCountSid
version
GetFileVersionInfoW
dsprop
ADsPropCreateNotifyObj
ADsPropSetHwndWithTitle
FindSheet
ADsPropSetHwnd
ADsPropGetInitInfo
ADsPropSendErrorMessage
ADsPropShowErrorDialog
user32
SetScrollInfo
SetWindowContextHelpId
RegisterWindowMessageW
SetWindowPos
PostMessageW
DialogBoxParamW
LoadStringW
MessageBoxW
ScrollWindow
DrawIcon
UpdateWindow
CreateWindowExW
GetWindowRect
GetWindowLongW
GetScrollInfo
CheckDlgButton
SetDlgItemTextW
GetClientRect
GetParent
SendMessageW
GetWindowTextLengthW
SetCursor
FindWindowExW
EnableWindow
FrameRect
GetDC
IsWindow
GetWindowThreadProcessId
SetWindowTextW
SystemParametersInfoW
DefWindowProcW
RegisterClipboardFormatW
EndDialog
ReleaseDC
GetWindow
GetDlgItemTextW
SetFocus
GetWindowTextW
MoveWindow
ShowWindow
MapWindowPoints
IsWindowEnabled
WinHelpW
GetDesktopWindow
DestroyIcon
LoadCursorW
GetSystemMetrics
SetForegroundWindow
MessageBoxA
GetSysColorBrush
wsprintfW
SetWindowLongW
MapDialogRect
LoadBitmapW
GetSysColor
LoadIconW
SetScrollPos
BeginPaint
IsDlgButtonChecked
SetScrollRange
ScreenToClient
DrawFocusRect
RegisterClassW
GetDlgItem
OffsetRect
MessageBeep
CheckRadioButton
DestroyWindow
SendDlgItemMessageW
GetDlgCtrlID
CallWindowProcW
InflateRect
EndPaint
advapi32
BuildTrusteeWithSidW
LsaQueryTrustedDomainInfoByName
LsaFreeMemory
IsValidSid
LsaSetForestTrustInformation
RegSetValueExW
InitializeSecurityDescriptor
CryptAcquireContextW
RevertToSelf
LsaLookupSids
SystemFunction040
SystemFunction041
RegDeleteKeyW
LsaOpenTrustedDomain
EqualSid
MakeSelfRelativeSD
AllocateAndInitializeSid
LsaSetTrustedDomainInfoByName
LsaQueryForestTrustInformation
RegCloseKey
BuildTrusteeWithObjectsAndSidW
CryptGenRandom
GetSidSubAuthorityCount
GetSecurityDescriptorDacl
OpenSCManagerW
GetSidSubAuthority
RegQueryValueExW
GetSidLengthRequired
RegCreateKeyExW
LsaOpenTrustedDomainByName
SetEntriesInAclW
SetNamedSecurityInfoW
CryptReleaseContext
GetLengthSid
ImpersonateAnonymousToken
EqualPrefixSid
GetExplicitEntriesFromAclW
QueryServiceStatus
LsaCreateTrustedDomainEx
LsaRetrievePrivateData
GetSecurityDescriptorLength
LsaQueryInformationPolicy
LsaQueryTrustedDomainInfo
LsaClose
LsaNtStatusToWinError
RegOpenKeyExW
GetSidIdentifierAuthority
ImpersonateLoggedOnUser
FreeSid
LsaOpenPolicy
InitializeAcl
LogonUserW
GetSecurityDescriptorControl
GetNamedSecurityInfoW
LsaDelete
OpenServiceW
CloseServiceHandle
gdi32
CreatePatternBrush
SetBkColor
GetTextExtentPoint32W
CreateFontIndirectW
GetDeviceCaps
SetTextColor
DeleteObject
CreateBitmap
ntdsapi
DsFreeNameResultW
DsIsMangledDnW
DsUnBindW
DsCrackNamesW
DsBindW
DsCrackSpn3W
apphelp
SetPermLayers
ole32
CoGetInterfaceAndReleaseStream
ReleaseStgMedium
CoGetApartmentID
StringFromIID
CoMarshalInterThreadInterfaceInStream
StringFromCLSID
CoCreateInstance
CoTaskMemFree
credui
CredUIInitControls
CredUIParseUserNameW
cryptui
CryptUIDlgViewCertificateW
CryptUIDlgSelectCertificateW
shell32
SHGetFolderPathW
crypt32
CryptDecodeObject
CertGetCertificateContextProperty
CertControlStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CryptFindOIDInfo
CryptQueryObject
CertDuplicateStore
CertSaveStore
CertFindCertificateInStore
CertGetNameStringW
CertEnumSystemStore
CertFreeCertificateContext
CertCloseStore
CertAddCertificateContextToStore
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertOpenStore
kernel32
GetLastError
VirtualAlloc
dnsapi
DnsNameCompareEx_W
shlwapi
PathIsUNCServerShareW
PathAppendW
Sections
.text Size: 512B - Virtual size: 400B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.data Size: 75KB - Virtual size: 848KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE