feaeb6ceb6d2831d0fa1092850611abd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

feaeb6ceb6d2831d0fa1092850611abd_JaffaCakes118
Size

950KB
MD5

feaeb6ceb6d2831d0fa1092850611abd
SHA1

147a83fa67085d302801d5832f6b8676211f09f4
SHA256

338c8fd67c7f35833fa8329b07fed566f6317637065af7e3676d0ec1f87dc016
SHA512

5ba8f70c42e0f900947af54676d327dfe94a298926ab50cdce5e76e197f174a226f8e83b9e93492d0cd38ac68c61aa8fc10f6718a596713d7095d7efc673c575
SSDEEP

12288:5pqiC/2OGAtkCP4cejGSOpRK3CGYZ3LsjN0T9efv:5po/2+ttPJLfpRK3CGYdkH

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
feaeb6ceb6d2831d0fa1092850611abd_JaffaCakes118

Files

feaeb6ceb6d2831d0fa1092850611abd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 495KB - Virtual size: 495KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ordata
Size: 199KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ezvipbn
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

eiycist
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE