Static task
static1
Behavioral task
behavioral1
Sample
eddc7fb220618debbd834bcd8af3eb48_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
eddc7fb220618debbd834bcd8af3eb48_JaffaCakes118
-
Size
512KB
-
MD5
eddc7fb220618debbd834bcd8af3eb48
-
SHA1
eab8235d004f92cb6405e8176c27f8ca874dd484
-
SHA256
672418c0e5acbfc1b2e0dd1afb1c98830df4536de7cb93a29fb5497397067ad4
-
SHA512
8b9bae819d4a87ff9487011b6077b06424e7c4ffadfbb8d370a582b92c9cd85972caaaa4f9033ec31342c507aea249fc681e23da5da0a1e0d582b23d7f8929e0
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6C:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eddc7fb220618debbd834bcd8af3eb48_JaffaCakes118
Files
-
eddc7fb220618debbd834bcd8af3eb48_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 399KB - Virtual size: 398KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ