Static task
static1
Behavioral task
behavioral1
Sample
f4349cf2547d6caf9d5fbb869f7d4c26_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f4349cf2547d6caf9d5fbb869f7d4c26_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f4349cf2547d6caf9d5fbb869f7d4c26_JaffaCakes118
-
Size
512KB
-
MD5
f4349cf2547d6caf9d5fbb869f7d4c26
-
SHA1
1a70285baf1da661cf8c1d198ad3f54aa516af1b
-
SHA256
09eccd8cdba282b1f03526a74daaad8bc28ad7ee22d676da8b4c4b1daf09b63a
-
SHA512
e5d0c840f9bbbd38463cba32179c28198ece663d5b1e6342cf5748d4465548bd655518c4b2b1728fbc4b0ab3097ea1e9a02e1088673c2996cec65b015d0c1d93
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6o:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5H
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f4349cf2547d6caf9d5fbb869f7d4c26_JaffaCakes118
Files
-
f4349cf2547d6caf9d5fbb869f7d4c26_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 399KB - Virtual size: 398KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ