Static task
static1
Behavioral task
behavioral1
Sample
136c89acfb542963a9dc99a265c08ee4_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
136c89acfb542963a9dc99a265c08ee4_JaffaCakes118
-
Size
502KB
-
MD5
136c89acfb542963a9dc99a265c08ee4
-
SHA1
4364791f14242e2447be844a0fbf9c5b8bbed21b
-
SHA256
422931202dfa4214ad564a05b02b589ab3caeaa343352d4d99c03926918bcd12
-
SHA512
16ceff38dfb2fe45f03f44000e97f2eafecf18df1ccdd15974e867cffad8ae58e0cab82e05525b73af76b1d1117f7a4ff9882e0d316b08b20759ebe2c6247405
-
SSDEEP
6144:2bS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9nHP:2QtqB5urTIoYWBQk1E+VF9mOx9v
Malware Config
Signatures
-
Nirsoft 1 IoCs
Processes:
resource yara_rule sample Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule sample MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule sample WebBrowserPassView -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 136c89acfb542963a9dc99a265c08ee4_JaffaCakes118
Files
-
136c89acfb542963a9dc99a265c08ee4_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 499KB - Virtual size: 498KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ