Behavioral task
behavioral1
Sample
29bd79b68a41df04b56f5de72b7c1be5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
29bd79b68a41df04b56f5de72b7c1be5_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
29bd79b68a41df04b56f5de72b7c1be5_JaffaCakes118
-
Size
832KB
-
MD5
29bd79b68a41df04b56f5de72b7c1be5
-
SHA1
6a7aff7192416d5beca05fd1de42524bab3126ae
-
SHA256
0dafc48dc10a85579b3e027c187e1aa934a307aaac73654e199626da27083abc
-
SHA512
d89a8025f84f22fa63359615b32f100cd475cc70951a17a82ae56557755aa0d33d61a1ebad3a702bc6a439b990d4ea2ebae1defeafa5cf6366f4b4209f6082d7
-
SSDEEP
24576:FxqT31T6WE6I5jKqosOmzbgKkknTTJ7S:86WE6IN95zbg
Malware Config
Signatures
-
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29bd79b68a41df04b56f5de72b7c1be5_JaffaCakes118
Files
-
29bd79b68a41df04b56f5de72b7c1be5_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 476KB - Virtual size: 476KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE