Static task
static1
Behavioral task
behavioral1
Sample
31382e6d5a5341e28304256fe3f76a10_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
31382e6d5a5341e28304256fe3f76a10_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
31382e6d5a5341e28304256fe3f76a10_JaffaCakes118
-
Size
3.9MB
-
MD5
31382e6d5a5341e28304256fe3f76a10
-
SHA1
68b181873710a4f9850061e3fffea859d65f43a8
-
SHA256
008e84c52a6a3dad5ad257c03e3fbcba6469ed4be02e5167543db54629b9d988
-
SHA512
1c529859fcd6ccd82d6ffa26494179b90709cd4eb2bfdb6748f71c46fd6eed7b30fe5e9a5afabce27b80b3a428303a9bd7c5424e708ec7bd917788bd8adf98a6
-
SSDEEP
98304:ItrbTA1G0O+lR4l1cHBz601/tw7XY099oLG/TEdYfsFjDQPp:Oc1fhbxJ1tw7XYYP/TCYU/Mp
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 31382e6d5a5341e28304256fe3f76a10_JaffaCakes118
Files
-
31382e6d5a5341e28304256fe3f76a10_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 514KB - Virtual size: 513KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ