Static task
static1
Behavioral task
behavioral1
Sample
d416ba589f9acef0f250675a80e9e8fe_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d416ba589f9acef0f250675a80e9e8fe_JaffaCakes118
-
Size
512KB
-
MD5
d416ba589f9acef0f250675a80e9e8fe
-
SHA1
508dcb228e231f63526aa9c35ce0ed9e96a68733
-
SHA256
eb660b08759bcf703983bc7b8d610b9606a67868a6fb15cca2cde990a874b905
-
SHA512
a0ccb53bec8bd53b65392bc97e39218df5857913a8cc703f0831f47cdcad8f7fe8eac63e7866945c68c74dd356a4fe532d9e8509839a0388a1dc4d40eac80658
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6d:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5A
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d416ba589f9acef0f250675a80e9e8fe_JaffaCakes118
Files
-
d416ba589f9acef0f250675a80e9e8fe_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 399KB - Virtual size: 398KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ