Static task
static1
Behavioral task
behavioral1
Sample
0d4e15410b7776b90df2f1513545854d_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0d4e15410b7776b90df2f1513545854d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0d4e15410b7776b90df2f1513545854d_JaffaCakes118
-
Size
171KB
-
MD5
0d4e15410b7776b90df2f1513545854d
-
SHA1
3bfef4d2c1bbcbc8e5fa8512115f45d300799bb9
-
SHA256
25fac1f16aec55f691f9c6b5d09e089728ae986fa71db7bce79392f52ee24388
-
SHA512
739c89d83a64c17c91000fbc1f022719c660dbec9e7409572624f99d337378b81610e7dec3747057c01bdc2b7516f32e7b180d2a81638b68293294bea458749a
-
SSDEEP
3072:xH4NCxRaDxifWMP5KNoElbjhSc1o765DHVDq9NC69dKrpDVh54zR6P:MCxWifWW5KKEzF1oGDHVDq3eDX54zkP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d4e15410b7776b90df2f1513545854d_JaffaCakes118
Files
-
0d4e15410b7776b90df2f1513545854d_JaffaCakes118.exe windows:5 windows x86 arch:x86
800d090fdfeefea17fb3b7dd2acdc8cb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
LsaClose
ConvertStringSidToSidW
InitializeAcl
ImpersonateLoggedOnUser
GetSecurityDescriptorOwner
GetSidIdentifierAuthority
GetSecurityDescriptorSacl
SystemFunction041
RegEnumKeyExW
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
OpenThreadToken
GetSecurityDescriptorLength
RegDeleteKeyW
RegSetKeySecurity
AddAce
RegCloseKey
GetLengthSid
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
RegSetValueExW
LookupAccountNameW
SetSecurityDescriptorGroup
LsaLookupSids
LsaFreeMemory
MakeSelfRelativeSD
SetSecurityDescriptorOwner
GetAclInformation
LsaNtStatusToWinError
RegConnectRegistryW
RegCreateKeyExW
SetFileSecurityW
GetAce
IsValidSid
LsaOpenPolicy
RevertToSelf
InitializeSecurityDescriptor
GetFileSecurityW
LookupAccountSidW
SetSecurityDescriptorSacl
RegOpenKeyExW
SystemFunction040
OpenProcessToken
RegGetKeySecurity
RegQueryValueExW
ole32
CoCreateFreeThreadedMarshaler
CreatePointerMoniker
CLSIDFromProgID
CoCreateInstance
CoInitialize
MkParseDisplayName
CoTaskMemAlloc
CoGetMalloc
CreateBindCtx
CLSIDFromString
StringFromCLSID
StringFromGUID2
mpr
WNetAddConnectionW
adsldpc
ReallocADsMem
GetDomainDNSNameForDomain
ADsSetLastError
AllocADsMem
ConvertSidToU2Trustee
FreeADsStr
FreeADsMem
ConvertSidToString
ADsGetLastError
ConvertU2TrusteeToSid
AllocADsStr
wsnmp32
SnmpGetTimeout
kernel32
FreeLibrary
LocalFree
Sleep
GetSystemDirectoryW
lstrlenW
EnterCriticalSection
SetUnhandledExceptionFilter
GetCurrentProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
CompareStringW
DisableThreadLibraryCalls
GetCurrentThreadId
LeaveCriticalSection
GetProcAddress
InterlockedDecrement
DeleteCriticalSection
GetCurrentThread
InterlockedIncrement
TerminateProcess
InitializeCriticalSection
GetTickCount
LocalAlloc
GetUserDefaultLCID
GetLastError
SetLastError
VirtualAlloc
GetVersionExW
CloseHandle
FormatMessageW
Sections
.text Size: 512B - Virtual size: 412B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 848KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ