Static task
static1
Behavioral task
behavioral1
Sample
75ae37bef5d89c72ae09b272ae92f57c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
75ae37bef5d89c72ae09b272ae92f57c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
75ae37bef5d89c72ae09b272ae92f57c_JaffaCakes118
-
Size
512KB
-
MD5
75ae37bef5d89c72ae09b272ae92f57c
-
SHA1
e6992b7c8b49bb3db9429e5a73da45e42555a17b
-
SHA256
ec99c8c30cc845e6aad8989662b030d250c33f85b38d2e198c9e955502c04280
-
SHA512
9020bb1e491690f082384dea18a67361eb492d970cf66ec9be2b6c79e1c3d42a5eec2bb8db779f9815bfae6a846ad1ebc80aad851ccf1b140f3eb4391dd7e34a
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5g
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 75ae37bef5d89c72ae09b272ae92f57c_JaffaCakes118
Files
-
75ae37bef5d89c72ae09b272ae92f57c_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 399KB - Virtual size: 398KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ