Static task
static1
Behavioral task
behavioral1
Sample
d2266fb36fdf4d3a6288e41d7964350c_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d2266fb36fdf4d3a6288e41d7964350c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d2266fb36fdf4d3a6288e41d7964350c_JaffaCakes118
-
Size
628KB
-
MD5
d2266fb36fdf4d3a6288e41d7964350c
-
SHA1
b3cb3bcc82c84938ca31a02d1455293120397c86
-
SHA256
b447323e09a6ec027aa8f6f972c9759e3f461591bb22472691855a1ca01bd58f
-
SHA512
6211e5ef513a17ee6b7f8436506b921e03dd466fabd60cd070826f107ca35851db141cf68e169970989ee8b2e0aba7b633b16a2f6e0a1daeefcc95c6034fc88b
-
SSDEEP
12288:oaWzgMg7v3qnCiMErQohh0F4CCJ8lnyi8CXrXjcP:/aHMv6Corjqnyi8CXrTcP
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2266fb36fdf4d3a6288e41d7964350c_JaffaCakes118
Files
-
d2266fb36fdf4d3a6288e41d7964350c_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 512KB - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ