67db36f75d2eda4f32e7026d12d802c9_JaffaCakes118 | Triage

Sharing

General

Target

67db36f75d2eda4f32e7026d12d802c9_JaffaCakes118
Size

4.8MB
MD5

67db36f75d2eda4f32e7026d12d802c9
SHA1

82bb04782810068f7cc59f5bfa77b193b7645c16
SHA256

bfebe495e7f5a945c1a9a052acd8ed8dfa081e6de15dc97da65a67cce2ef80e6
SHA512

be06ec5844a33d7d8e6d4217233b81539070ad1f93f7cda8d83ba64774c0375e3f9664da8c16eea4b5deff25a7df43c1f5e39d3fb7a565645e7d449de0725d96
SSDEEP

98304:q2cPK8B4b+PI7nhdJh0lyOTDOVkxCL1D/paWLSW+pezcXlo:FCKg4bSIPJhBOOVkxMD/lopeAVo

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67db36f75d2eda4f32e7026d12d802c9_JaffaCakes118

Files

67db36f75d2eda4f32e7026d12d802c9_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 568KB - Virtual size: 567KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 470KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.enigma1
Size: 3.2MB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enigma2
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE