Static task
static1
Behavioral task
behavioral1
Sample
5_netplwiz.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5_netplwiz.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
6_mqtrig.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
6_mqtrig.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
7_msdtckrm.dll
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_584535560c1edb7f31466ce2efacf0cd4ca94cb91929aaf08f22ac530071f88e
-
Size
368KB
-
MD5
3895d9b1fb4d0683851cb2e447946db5
-
SHA1
bc0ab78947a6b4d139c8c02ef4d1988bde9972bd
-
SHA256
584535560c1edb7f31466ce2efacf0cd4ca94cb91929aaf08f22ac530071f88e
-
SHA512
44424f9a06d3aa8a5ae869e569636ff67cb7e4a8581c586bc830cc469f3f214616d5f4bb3b441ce2d6f086aa336f6d709853ce87d77852829f569a4c9da5c333
-
SSDEEP
6144:GEKL3LknXHDIPiF2Sck8Frj8wtUYt56+osCoN/8ZICr8AdIeD7+tjtchmkY5f5dE:T2bknXHDI6MSckUgwtUI56+o56El3dim
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/5_netplwiz.dll unpack001/6_mqtrig.dll unpack001/7_msdtckrm.dll
Files
-
JaffaCakes118_584535560c1edb7f31466ce2efacf0cd4ca94cb91929aaf08f22ac530071f88e.zip
-
5_netplwiz.dll.dll windows:5 windows x86 arch:x86
b927e2fd6505c671ddbf01624ff63d85
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shell32
SHGetDesktopFolder
user32
ShowOwnedPopups
msvcrt
memset
iphlpapi
GetIfTable
setupapi
SetupDiEnumDeviceInfo
advapi32
RegOverridePredefKey
oleaut32
VarR4FromI8
kernel32
GetModuleFileNameW
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 132KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
6_mqtrig.dll.dll windows:5 windows x86 arch:x86
b927e2fd6505c671ddbf01624ff63d85
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shell32
SHGetDesktopFolder
user32
ShowOwnedPopups
msvcrt
memset
iphlpapi
GetIfTable
setupapi
SetupDiEnumDeviceInfo
advapi32
RegOverridePredefKey
oleaut32
VarR4FromI8
kernel32
GetModuleFileNameW
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
7_msdtckrm.dll.dll windows:5 windows x86 arch:x86
b927e2fd6505c671ddbf01624ff63d85
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shell32
SHGetDesktopFolder
user32
ShowOwnedPopups
msvcrt
memset
iphlpapi
GetIfTable
setupapi
SetupDiEnumDeviceInfo
advapi32
RegOverridePredefKey
oleaut32
VarR4FromI8
kernel32
GetModuleFileNameW
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 132KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ