Static task
static1
Behavioral task
behavioral1
Sample
dffb56c50f880be16858c2360cb352be_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dffb56c50f880be16858c2360cb352be_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dffb56c50f880be16858c2360cb352be_JaffaCakes118
-
Size
58KB
-
MD5
dffb56c50f880be16858c2360cb352be
-
SHA1
903299f065b5ffabac933e46a98666d69fa0293a
-
SHA256
b7729e27be25d35305a76a48744d52ae272fa9222bb6b5d724fe6cae6f731a86
-
SHA512
6302df1bcd80f22aa43fdaf95cd985cd2d8660b752fb16c860db8c1a42cff70f5c96e6076e8e9e88df9a868c1d59cbe935c1558eb8fbd7fa3d4d810bade02e49
-
SSDEEP
1536:Gt8JRlClUVeGLPxOLBvOVk96iOijXEVDsO:1vlClqDQFvR96iOQiDs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dffb56c50f880be16858c2360cb352be_JaffaCakes118
Files
-
dffb56c50f880be16858c2360cb352be_JaffaCakes118.exe windows:1 windows x86 arch:x86
7cdab8d5eb4120796a50b060586db25e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kerberos
KerbIsInitialized
ntdsapi
DsGetSpnW
DsMakeSpnW
DsCrackSpnW
DsIsMangledDnW
DsFreePasswordCredentials
DsFreeSchemaGuidMapW
DsMakePasswordCredentialsW
DsServerRegisterSpnW
DsFreeSpnArrayW
DsIsMangledRdnValueA
iepeers
DllEnumClassObjects
objsel
DllUnregisterServer
DllCanUnloadNow
DllRegisterServer
DllGetClassObject
kernel32
FindFirstVolumeMountPointW
OpenEventW
VDMOperationStarted
PurgeComm
SetProcessPriorityBoost
SetStdHandle
GetModuleFileNameA
GetProfileSectionW
GlobalFlags
GetNextVDMCommand
CloseConsoleHandle
GetBinaryTypeW
InterlockedExchange
SetFileAttributesA
GlobalLock
GetProcAddress
DisableThreadLibraryCalls
EnumResourceNamesW
SetEnvironmentVariableA
GetLargestConsoleWindowSize
GetCommConfig
GetCurrentThread
DeleteCriticalSection
EnumResourceLanguagesW
_lcreat
RtlMoveMemory
user32
SetWindowLongA
GetScrollBarInfo
ImpersonateDdeClientWindow
GetFocus
RedrawWindow
GetLastInputInfo
IsWindow
CalcMenuBar
GetAsyncKeyState
DrawTextA
GetKBCodePage
TrackPopupMenu
EnumWindowStationsA
IMPSetIMEA
GetWindowLongA
OpenDesktopA
LoadStringW
SetShellWindow
DdeCreateStringHandleW
GetWindowRect
UserHandleGrantAccess
IsWinEventHookInstalled
LoadMenuW
ModifyMenuA
GetProcessDefaultLayout
LoadAcceleratorsA
mouse_event
GetWindowTextA
DrawStateA
GetShellWindow
WindowFromPoint
msrating
RatingCustomAddRatingHelper
RatingInit
VerifySupervisorPassword
RatingCustomRemoveRatingHelper
hlink
HlinkCreateFromString
HlinkParseDisplayName
HlinkResolveShortcutToMoniker
HlinkQueryCreateFromData
Sections
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ