Static task
static1
Behavioral task
behavioral1
Sample
728ee6380c1b5bdd70c8cefdf220bdf6_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
728ee6380c1b5bdd70c8cefdf220bdf6_JaffaCakes118
-
Size
924KB
-
MD5
728ee6380c1b5bdd70c8cefdf220bdf6
-
SHA1
ea3f8b746a94ca0ae00d3eb633b9111d1f33ec3e
-
SHA256
49df1325d7fce93149067701c3a8cfe904ff5ec7680d2757deb2b4057bbd8d22
-
SHA512
978a96e8d7251235a1b5e21802cdbcbc2901bdc6bc0c36d0e442db5ec85cb338b6667ddaeed75592a8541f46b73e78566d8b97e7163dc8103ef820dfbca948e8
-
SSDEEP
24576:cjQG0Q3SSuLEXeV7SmNIeM1xanssOPFanssOP:gzN3SlQCPI1
Malware Config
Signatures
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule sample Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule sample MailPassView -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 728ee6380c1b5bdd70c8cefdf220bdf6_JaffaCakes118
Files
-
728ee6380c1b5bdd70c8cefdf220bdf6_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 904KB - Virtual size: 904KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE