Static task
static1
Behavioral task
behavioral1
Sample
f978b2c4365acecb5898b9b84fb6f324_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
f978b2c4365acecb5898b9b84fb6f324_JaffaCakes118
-
Size
1.3MB
-
MD5
f978b2c4365acecb5898b9b84fb6f324
-
SHA1
b4f0bb02c6e5a155612d09281dec02cb9ea94679
-
SHA256
1042296202bd4c7586165a1b804dfe428ebbfb333993ee7e3c213ca367f9051c
-
SHA512
9533b5eee411ba6c90114107857e37aa11412989a9249a23f9aa0a8b7fa2368c884fbaa69c8d3bd9616324e806fba9c8ec54ef4bfaf2c724146521cc48a9c033
-
SSDEEP
24576:WVkMxyGo3vKR/VcZMpA2YnGtjKE4oPylU26r0A+lE4Ad:WVTxsv6A2YnGtOE4oKxW0jErd
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f978b2c4365acecb5898b9b84fb6f324_JaffaCakes118
Files
-
f978b2c4365acecb5898b9b84fb6f324_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 563KB - Virtual size: 563KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 230KB - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ