Static task
static1
Behavioral task
behavioral1
Sample
3cff5fab01d717d9c97d0c3c924b81dd_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3cff5fab01d717d9c97d0c3c924b81dd_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3cff5fab01d717d9c97d0c3c924b81dd_JaffaCakes118
-
Size
452KB
-
MD5
3cff5fab01d717d9c97d0c3c924b81dd
-
SHA1
893d555d87b5e93bb91841f9f20bcda05d4bc66b
-
SHA256
080b9ae8b110caaca131a3aceb60ea677d0dcc6be11de2309cad07a51c707319
-
SHA512
58b790dc257ff6c94087d2f8858c00b7fa587af61982e913d2d9d22b1a4b8191942103112b827884a41c2b2d5ce18b27e7583a994055b7b86acb0e407cc2425b
-
SSDEEP
12288:ANidGxc4O98Twn+aQ5tfgHn429HTZ34zXzCj7sdaAYUb:ANQGSt8IXQ51gH429H134zziCY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cff5fab01d717d9c97d0c3c924b81dd_JaffaCakes118
Files
-
3cff5fab01d717d9c97d0c3c924b81dd_JaffaCakes118.exe windows:5 windows x86 arch:x86
e6eeba611096acae1ec55db5c14bcbe4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42u
ord4213
ord2570
ord4392
ord3577
ord3605
ole32
ReleaseStgMedium
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
GetHGlobalFromStream
CoTaskMemAlloc
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CoCreateInstance
advapi32
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
InitializeSecurityDescriptor
CopySid
GetLengthSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegDeleteKeyW
RegEnumKeyExW
LsaOpenPolicy
LsaLookupNames
GetSidSubAuthorityCount
GetSidSubAuthority
LsaFreeMemory
LsaOpenAccount
LsaCreateAccount
LsaGetSystemAccessAccount
LsaSetSystemAccessAccount
LsaClose
GetSecurityDescriptorLength
GetSecurityDescriptorControl
AllocateAndInitializeSid
MakeSelfRelativeSD
FreeSid
MapGenericMask
ControlService
StartServiceW
EnumDependentServicesW
ChangeServiceConfigW
QueryServiceStatusEx
RevertToSelf
IsWellKnownSid
RegConnectRegistryW
QueryServiceStatus
GetUserNameW
RegDeleteValueW
EnumServicesStatusW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorDacl
shlwapi
ord437
gdi32
DeleteObject
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj5 Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj50 Size: 512B - Virtual size: 222B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj51 Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj52 Size: 204KB - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj53 Size: 204KB - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj54 Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj55 Size: 512B - Virtual size: 214B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fhj56 Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fhj57 Size: 512B - Virtual size: 214B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fhj58 Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fhj59 Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1231 Size: 512B - Virtual size: 214B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.JAKS Size: 512B - Virtual size: 246B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.GAHS Size: 512B - Virtual size: 198B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.HAJS Size: 512B - Virtual size: 458B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.HnJS Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SKALS Size: 512B - Virtual size: 242B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SKAkS Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SfAkS Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 318B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ