Static task
static1
Behavioral task
behavioral1
Sample
f28c529c64c3e343e003c5dafb043e8d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f28c529c64c3e343e003c5dafb043e8d_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f28c529c64c3e343e003c5dafb043e8d_JaffaCakes118
-
Size
2.7MB
-
MD5
f28c529c64c3e343e003c5dafb043e8d
-
SHA1
b97c810f232d446cb59f626c9c41f17c17080900
-
SHA256
86e9f32ae87f2c69cee73ea6c750c1e6407eaa8c1752657467543b86d4b9b678
-
SHA512
ed206bfcfc46f460b91d98ac4a336f878781deaaf9d00222445fb0303e278deb123356a601108804ff3976f55e78c2bfcfaab9feafc731293e6aa05a91d52345
-
SSDEEP
49152:G/nUjOFZYeiLxPQ6u4sOEvazaoGlesKHg9nQ9Nc9S3eEjj5ec56f:anUEZmLhQ6zsBne4RSLj5ec
Malware Config
Signatures
-
Nirsoft 1 IoCs
resource yara_rule sample Nirsoft -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f28c529c64c3e343e003c5dafb043e8d_JaffaCakes118
Files
-
f28c529c64c3e343e003c5dafb043e8d_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VV Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE