Static task
static1
Behavioral task
behavioral1
Sample
db2aad78165464d2a76f27c287bbfb9d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db2aad78165464d2a76f27c287bbfb9d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
db2aad78165464d2a76f27c287bbfb9d_JaffaCakes118
-
Size
171KB
-
MD5
db2aad78165464d2a76f27c287bbfb9d
-
SHA1
31809e3bff83866251cf27609c4057c3a7f1d292
-
SHA256
40d85ef1e63ff41c37ac42fb7510eb95730413354e14a645e2d6b9a9804cd4fb
-
SHA512
58f6327a85dc4f45ed5c3c02b55f21324611b6a9a6fb2c807ab2f12713a6cf302652ceb37129868292957d3952fe22cde7a4397bbc1f7d54953daabe69c0d369
-
SSDEEP
3072:8j3Tv4gnaAlU9go0QmaXkB/3JoRzU7zjqDFwvUtNKQX7vXsHsMeG9lJ6q40/1:8Pv4gaAnoYaX8/3mw7zGDFwvcN5LisMH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db2aad78165464d2a76f27c287bbfb9d_JaffaCakes118
Files
-
db2aad78165464d2a76f27c287bbfb9d_JaffaCakes118.exe windows:5 windows x86 arch:x86
08a573dd4db879c4839801e9baa82e1a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetAclInformation
ConvertStringSidToSidW
GetSecurityDescriptorDacl
RegConnectRegistryW
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SystemFunction041
GetSecurityDescriptorOwner
MakeSelfRelativeSD
GetSecurityDescriptorGroup
LsaFreeMemory
RevertToSelf
SetSecurityDescriptorSacl
GetAce
GetSecurityDescriptorControl
SetSecurityDescriptorGroup
SetFileSecurityW
RegCloseKey
OpenThreadToken
GetSecurityDescriptorLength
InitializeSecurityDescriptor
GetLengthSid
LookupAccountNameW
GetFileSecurityW
RegGetKeySecurity
ImpersonateLoggedOnUser
SystemFunction040
LookupAccountSidW
LsaClose
IsValidSid
SetSecurityDescriptorOwner
RegEnumKeyExW
RegQueryValueExW
GetSidIdentifierAuthority
LsaLookupSids
RegCreateKeyExW
OpenProcessToken
RegSetKeySecurity
RegSetValueExW
LsaOpenPolicy
AddAce
InitializeAcl
RegOpenKeyExW
RegDeleteKeyW
LsaNtStatusToWinError
mpr
WNetAddConnectionW
ole32
StringFromGUID2
CLSIDFromProgID
CoGetMalloc
CreatePointerMoniker
MkParseDisplayName
CLSIDFromString
StringFromCLSID
CoCreateInstance
CoInitialize
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CreateBindCtx
adsldpc
ConvertU2TrusteeToSid
AllocADsMem
FreeADsStr
ReallocADsMem
ADsSetLastError
FreeADsMem
ADsGetLastError
ConvertSidToU2Trustee
ConvertSidToString
GetDomainDNSNameForDomain
AllocADsStr
wsnmp32
SnmpGetTimeout
kernel32
UnhandledExceptionFilter
GetSystemDirectoryW
InitializeCriticalSection
FreeLibrary
VirtualAlloc
DisableThreadLibraryCalls
GetCurrentThreadId
GetVersionExW
InterlockedIncrement
GetTickCount
FormatMessageW
LoadLibraryW
GetCurrentThread
TerminateProcess
CompareStringW
GetCurrentProcess
LocalAlloc
GetProcAddress
GetSystemTimeAsFileTime
InterlockedDecrement
GetLastError
Sleep
GetUserDefaultLCID
CloseHandle
QueryPerformanceCounter
GetCurrentProcessId
EnterCriticalSection
SetLastError
LeaveCriticalSection
LocalFree
SetUnhandledExceptionFilter
DeleteCriticalSection
Sections
.text Size: 512B - Virtual size: 412B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 848KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ