Static task
static1
Behavioral task
behavioral1
Sample
2e39778f671d78b328c58a7cff6d3cbf_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2e39778f671d78b328c58a7cff6d3cbf_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2e39778f671d78b328c58a7cff6d3cbf_JaffaCakes118
-
Size
1.1MB
-
MD5
2e39778f671d78b328c58a7cff6d3cbf
-
SHA1
1701122e0ad0cad523752f59dbceff87647c7de9
-
SHA256
dafee764a8e47a263cb8c478fb7304855243b0fafa8aea89d3c899815716d3b6
-
SHA512
7d7748136b58b219ef0eff72f283d97a9e20c6a0cb255801f96358d6497f8c9eb180e004187f30b7cfc86ec83e956acad98760e431a314db16c26dfd201e1c53
-
SSDEEP
12288:IUEf2YRo2cc+bLQ7S1ilBE3muzmZDiOnrp4j/4qeRbxMrKEliOB39N8BvuCh:of1Rohc+bLGSOuSfrpYQqrrZwOdcv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e39778f671d78b328c58a7cff6d3cbf_JaffaCakes118
Files
-
2e39778f671d78b328c58a7cff6d3cbf_JaffaCakes118.exe windows:9 windows x86 arch:x86
9f2e93739439a7dea00d980e3d91a382
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
shell32
ExtractIconA
ILIsEqual
ILClone
ReadCabinetState
RealDriveType
PrintersGetCommand_RunDLL
ILCombine
CDefFolderMenu_Create2
RealShellExecuteA
PifMgr_OpenProperties
RealShellExecuteExA
ExtractIconEx
DAD_DragMove
DragFinish
PathCleanupSpec
OpenAs_RunDLLA
IsUserAnAdmin
ILRemoveLastID
ILFree
adsldpc
ADsGetPreviousRow
ADsWriteClassDefinition
AdsTypeToLdapTypeCopyTime
ADSICloseSearchHandle
AdsTypeToLdapTypeCopyGeneralizedTime
ADsDecodeBinaryData
ADSIGetNextColumnName
ADsGetObjectAttributes
BuildLDAPPathFromADsPath2
ADsWriteAttributeDefinition
ADSIGetPreviousRow
ADsExecuteSearch
ADsFreeColumn
ADSICloseDSObject
ADSIAbandonSearch
ADSICreateDSObject
GetDomainDNSNameForDomain
kernel32
EnterCriticalSection
InitializeCriticalSection
ExitProcess
CloseHandle
CopyFileA
WaitForSingleObject
GetCurrentThreadId
VirtualAlloc
VirtualFree
LeaveCriticalSection
Sections
.text Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrcs Size: 652KB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ