Static task
static1
Behavioral task
behavioral1
Sample
1886847aca6f004f625f2a37d32bedb0_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1886847aca6f004f625f2a37d32bedb0_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1886847aca6f004f625f2a37d32bedb0_JaffaCakes118
-
Size
580KB
-
MD5
1886847aca6f004f625f2a37d32bedb0
-
SHA1
e8ed59161f134ab59ca591dbd70bea9faa4bf3be
-
SHA256
232b7caf430b06ba20f142edf59b6775090173f599ee3f1b2ad5c472666a2abc
-
SHA512
e552915435aa054a956b5b7946bca8643e5844edf08c8fa0c63930f7cd7f104859e44b93df401340e097d6e7976885bbbcd134a9f1f8b23f007cf77c0ba6d329
-
SSDEEP
12288:dF70zF8ztcC/aSFxNYco+gunl2AopFbz8fCEAWOtQ8ii:XgOpFxqZunl2AeFbQ6r
Malware Config
Signatures
-
Nirsoft 1 IoCs
resource yara_rule sample Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule sample MailPassView -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1886847aca6f004f625f2a37d32bedb0_JaffaCakes118
Files
-
1886847aca6f004f625f2a37d32bedb0_JaffaCakes118.exe windows:4 windows x86 arch:x86
7e4a69869c2fcf27485c185556cd0f70
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord667
ord631
ord632
ord526
DllFunctionCall
__vbaExceptHandler
ord711
ord712
ord713
ProcCallEngine
ord537
ord644
ord570
ord573
ord100
ord619
Sections
.text Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 560KB - Virtual size: 559KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ