Static task
static1
Behavioral task
behavioral1
Sample
b1236562a2b2a929a15392546a37dc65_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b1236562a2b2a929a15392546a37dc65_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b1236562a2b2a929a15392546a37dc65_JaffaCakes118
-
Size
171KB
-
MD5
b1236562a2b2a929a15392546a37dc65
-
SHA1
02a06ea62af36922e37d971720ef8cc77cef7807
-
SHA256
43b2976a6a73c4ef6c8a49069248f0025741f79b0b1a215a9e29d2a59762ca94
-
SHA512
34c9b2df36b9a2d2f8a379da8fd30c79418f89b8e80dcd94deae6c25e91f0fc62121c1bc8469ced14129fbe892fa10723b351e8940f8733210f8308a321c7ed6
-
SSDEEP
3072:2DEN/2cnPJQ4ivlYSVLRH3W2p0kZr+vozxjweZHW5/UP5XQgnL2/rtfHRoKQ9Leo:2D++cPSOIXP7xEeh57aJHRoK2eP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1236562a2b2a929a15392546a37dc65_JaffaCakes118
Files
-
b1236562a2b2a929a15392546a37dc65_JaffaCakes118.exe windows:5 windows x86 arch:x86
2b378e0ae98e6e3d7e733a336dcc00ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wsnmp32
SnmpGetTimeout
ole32
CoGetMalloc
CoCreateFreeThreadedMarshaler
MkParseDisplayName
CoTaskMemAlloc
CreatePointerMoniker
CLSIDFromProgID
CLSIDFromString
CreateBindCtx
CoInitialize
StringFromCLSID
StringFromGUID2
CoTaskMemFree
mpr
MultinetGetConnectionPerformanceA
advapi32
GetLengthSid
RegSetValueExW
AddAce
SetFileSecurityW
OpenProcessToken
RegCloseKey
LsaLookupSids
LookupAccountNameW
GetSecurityDescriptorControl
GetSecurityDescriptorGroup
RevertToSelf
LsaNtStatusToWinError
SetSecurityDescriptorOwner
GetSecurityDescriptorLength
LookupAccountSidW
ImpersonateLoggedOnUser
GetSecurityDescriptorOwner
RegDeleteKeyW
GetSecurityDescriptorSacl
LsaOpenPolicy
GetAclInformation
GetSidIdentifierAuthority
RegEnumKeyExW
IsValidSid
SystemFunction040
GetSecurityDescriptorDacl
ConvertStringSidToSidW
RegQueryValueExW
SetSecurityDescriptorGroup
GetFileSecurityW
RegOpenKeyExW
InitializeSecurityDescriptor
SystemFunction041
MakeSelfRelativeSD
OpenThreadToken
RegCreateKeyExW
RegSetKeySecurity
RegGetKeySecurity
LsaClose
SetSecurityDescriptorDacl
InitializeAcl
LsaFreeMemory
RegConnectRegistryW
SetSecurityDescriptorSacl
GetAce
netapi32
NetApiBufferFree
NetShareSetInfo
NetShareGetInfo
adsldpc
FreeADsStr
ADsGetLastError
ReallocADsMem
AllocADsStr
ADsSetLastError
ConvertU2TrusteeToSid
ConvertSidToU2Trustee
GetDomainDNSNameForDomain
ConvertSidToString
AllocADsMem
FreeADsMem
kernel32
TerminateProcess
QueryPerformanceCounter
GetUserDefaultLCID
SetLastError
DeleteCriticalSection
LocalAlloc
GetCurrentThread
LoadLibraryW
CloseHandle
GetLastError
GetSystemTimeAsFileTime
GetCurrentThreadId
lstrlenW
LeaveCriticalSection
SetUnhandledExceptionFilter
Sleep
InterlockedIncrement
GetCurrentProcessId
FreeLibrary
GetProcAddress
InitializeCriticalSection
CompareStringW
GetVersionExW
EnterCriticalSection
FormatMessageW
GetCurrentProcess
InterlockedDecrement
DisableThreadLibraryCalls
GetSystemDirectoryW
VirtualAlloc
UnhandledExceptionFilter
LocalFree
Sections
.text Size: 512B - Virtual size: 408B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 848KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ