Static task
static1
Behavioral task
behavioral1
Sample
Profiel.Doc_____________________________________________________________________.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Profiel.Doc_____________________________________________________________________.exe
Resource
win10v2004-20240802-en
General
-
Target
b2e369a969713945cf60971e7f9ea739_JaffaCakes118
-
Size
43KB
-
MD5
b2e369a969713945cf60971e7f9ea739
-
SHA1
6bf98a2788e6e48e25d9afd6cf43a66ad951b66b
-
SHA256
30320990ace1b3699065be9ffb2525b3f63ce34f1d2525505436cf30b1265f49
-
SHA512
38225028f5b0eba55fc1eb18416030ab6329e8d75c965380e2456731f9ef48151df313e71fac5e0f0bc46e8988605ffa069906fa8a2a67d9b704cb9e827eccb6
-
SSDEEP
768:XUZVw8ZBMUBQcjVqI77KbAohMw3nJzSNz+1t0Uf28Ur6P/Z4cNZ:kDBZ9mXP+sfLK6P/24
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Profiel.Doc_____________________________________________________________________.exe
Files
-
b2e369a969713945cf60971e7f9ea739_JaffaCakes118.zip
-
Profiel.Doc_____________________________________________________________________.exe.exe windows:1 windows x86 arch:x86
7cdab8d5eb4120796a50b060586db25e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kerberos
KerbIsInitialized
ntdsapi
DsGetSpnW
DsMakeSpnW
DsCrackSpnW
DsIsMangledDnW
DsFreePasswordCredentials
DsFreeSchemaGuidMapW
DsMakePasswordCredentialsW
DsServerRegisterSpnW
DsFreeSpnArrayW
DsIsMangledRdnValueA
iepeers
DllEnumClassObjects
objsel
DllUnregisterServer
DllCanUnloadNow
DllRegisterServer
DllGetClassObject
kernel32
FindFirstVolumeMountPointW
OpenEventW
VDMOperationStarted
PurgeComm
SetProcessPriorityBoost
SetStdHandle
GetModuleFileNameA
GetProfileSectionW
GlobalFlags
GetNextVDMCommand
CloseConsoleHandle
GetBinaryTypeW
InterlockedExchange
SetFileAttributesA
GlobalLock
GetProcAddress
DisableThreadLibraryCalls
EnumResourceNamesW
SetEnvironmentVariableA
GetLargestConsoleWindowSize
GetCommConfig
GetCurrentThread
DeleteCriticalSection
EnumResourceLanguagesW
_lcreat
RtlMoveMemory
user32
SetWindowLongA
GetScrollBarInfo
ImpersonateDdeClientWindow
GetFocus
RedrawWindow
GetLastInputInfo
IsWindow
CalcMenuBar
GetAsyncKeyState
DrawTextA
GetKBCodePage
TrackPopupMenu
EnumWindowStationsA
IMPSetIMEA
GetWindowLongA
OpenDesktopA
LoadStringW
SetShellWindow
DdeCreateStringHandleW
GetWindowRect
UserHandleGrantAccess
IsWinEventHookInstalled
LoadMenuW
ModifyMenuA
GetProcessDefaultLayout
LoadAcceleratorsA
mouse_event
GetWindowTextA
DrawStateA
GetShellWindow
WindowFromPoint
msrating
RatingCustomAddRatingHelper
RatingInit
VerifySupervisorPassword
RatingCustomRemoveRatingHelper
hlink
HlinkCreateFromString
HlinkParseDisplayName
HlinkResolveShortcutToMoniker
HlinkQueryCreateFromData
Sections
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ