?aiaioioi@@YGXHHH@Z
Static task
static1
Behavioral task
behavioral1
Sample
2581acbf7788dbdeabfe43094b12130e_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2581acbf7788dbdeabfe43094b12130e_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
2581acbf7788dbdeabfe43094b12130e_JaffaCakes118
-
Size
442KB
-
MD5
2581acbf7788dbdeabfe43094b12130e
-
SHA1
71cdf1d6f79110d6bd47445a344f248d593ca760
-
SHA256
b9b9bdc859b935df957993f63add3049d3afee9cfee0baa32d5187456ab829ce
-
SHA512
d4de664bed30601b3500b11ebb55d17f6b33b50ebd190c86b90bb2006142391b4fa4344af659c0485f6a9b05a91f07cf08191bcd352cb85ffa0e6898e5f27eb4
-
SSDEEP
12288:pCQXpcejVYbNnNSBInY6Vvb9jjdEnkXRL8hjao:pn+OVENnnY09XdPRLcao
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2581acbf7788dbdeabfe43094b12130e_JaffaCakes118
Files
-
2581acbf7788dbdeabfe43094b12130e_JaffaCakes118.exe windows:5 windows x86 arch:x86
974f05dd289025f5851d275d2d3341e6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_adjust_fdiv
malloc
_initterm
free
wcsrchr
_wcsicmp
wcscpy
wcscat
wcslen
_except_handler3
wintrust
CryptCATAdminCalcHashFromFileHandle
rpcrt4
RpcRevertToSelfEx
I_RpcBindingIsClientLocal
RpcServerUnregisterIf
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcStringFreeW
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcImpersonateClient
RpcRevertToSelf
NdrServerCall2
user32
wsprintfW
wsprintfA
kernel32
FindNextFileW
GetACP
WideCharToMultiByte
GetSystemDirectoryW
GetSystemDirectoryA
advapi32
RegCloseKey
RegEnumValueW
RegEnumValueA
RegCreateKeyExA
CryptAcquireContextA
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
CryptSetProviderExW
CryptGetDefaultProviderW
CryptGetProvParam
CryptEnumProviderTypesW
CryptEnumProvidersW
LsaOpenPolicy
LsaRetrievePrivateData
LogonUserW
LsaFreeMemory
LsaClose
ImpersonateLoggedOnUser
RegOpenKeyExW
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
GetLengthSid
CopySid
CryptReleaseContext
SystemFunction036
RevertToSelf
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
OpenThreadToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerW
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
certcli
CACertTypeAccessCheck
CAGetCertTypeProperty
CACountCertTypes
CAFreeCertTypeProperty
CAEnumNextCertType
CAEnumCertTypes
CACloseCA
CAEnumNextCA
CAFreeCAProperty
CAAccessCheck
CAGetCAProperty
CACountCAs
CAEnumFirstCA
CACloseCertType
crypt32
CertFreeCTLContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
PFXExportCertStore
PFXImportCertStore
CertCreateContext
CertCloseStore
CryptDecodeObject
esent
JetTerm
JetUpdate
JetSetColumn
JetPrepareUpdate
JetDelete
JetMove
JetMakeKey
JetRetrieveColumn
JetSetSystemParameter
JetCloseTable
JetGetColumnInfo
JetOpenTable
JetRollback
JetCommitTransaction
JetCreateIndex
JetAddColumn
JetCreateTable
JetBeginTransaction
JetOpenDatabase
JetCloseDatabase
JetCreateDatabase
JetSetCurrentIndex
JetAttachDatabase
JetBeginSession
JetInit
JetDetachDatabase
JetEndSession
JetSeek
Exports
Exports
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.asas Size: 415KB - Virtual size: 416KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ