Behavioral task
behavioral1
Sample
DShutdown/DShutdown.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
DShutdown/DShutdown.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
DShutdown/RDShutdown Setup Utility.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
DShutdown/RDShutdown Setup Utility.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
DShutdown/RDShutdown.exe
Resource
win7-20240705-en
General
-
Target
6f52dfc1dfd336e78d20577b7660230d_JaffaCakes118
-
Size
248KB
-
MD5
6f52dfc1dfd336e78d20577b7660230d
-
SHA1
9c39c30615199abe8c224a34b281ad138638a936
-
SHA256
6726b06d2a8e9c76acb5a9b353ead3ecbb09b584fc15862896589b240b825bb8
-
SHA512
c5d62a176a625c437c5915be8bac8eea9f58b49c9661952eb74839754ebb777550136945d444c8abc9cebbc20d68cdbe793564dd2dd1fe86b2a6ed7ba5453b50
-
SSDEEP
6144:lAXIrw07FIrgxGhEiZGlBB1CH1g6YEcEin3/IptrF5Q0ZAMdNPlz2mjqI:lAsw07FIc+irR643/mZ5XOMTQI
Malware Config
Signatures
-
resource yara_rule static1/unpack001/DShutdown/DShutdown.exe upx static1/unpack001/DShutdown/RDShutdown Setup Utility.exe upx static1/unpack001/DShutdown/RDShutdown.exe upx -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/DShutdown/DShutdown.exe unpack001/DShutdown/RDShutdown Setup Utility.exe unpack001/DShutdown/RDShutdown.exe
Files
-
6f52dfc1dfd336e78d20577b7660230d_JaffaCakes118.zip
-
DShutdown/DShutdown (ENG).txt
-
DShutdown/DShutdown (ITA).txt
-
DShutdown/DShutdown.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 416KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
DShutdown/History (ITA).txt
-
DShutdown/License (ENG).txt
-
DShutdown/RDShutdown (ENG).txt
-
DShutdown/RDShutdown (ITA).txt
-
DShutdown/RDShutdown Setup Utility (ENG).txt
-
DShutdown/RDShutdown Setup Utility (ITA).txt
-
DShutdown/RDShutdown Setup Utility.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
DShutdown/RDShutdown.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 168KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 72KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE