Behavioral task
behavioral1
Sample
008d0d67ab01350c96f5f4e2c3b5e78e_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
008d0d67ab01350c96f5f4e2c3b5e78e_JaffaCakes118
-
Size
249KB
-
MD5
008d0d67ab01350c96f5f4e2c3b5e78e
-
SHA1
03ac17e0c9ec1abd8de98c95befddb910399f6b7
-
SHA256
b8f158eeb690ee02016a93fdc639e6e903ec76d243db81a1310c43af0a6cbf8f
-
SHA512
7414d0866b810651568df17fc08b064c4f27b25ea5d4904a64193f75e255b5f34b26cf195c1269c6631d3654c0b0fcb778793a0c78d4606fc5d793c4c1b3908f
-
SSDEEP
6144:auJKq3G5Li4VSaIHVhfo6YiBshMPWsAMy6WqzKaRqK4o:auveLlVhGhwwBU+Wsg6WqPRH
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 008d0d67ab01350c96f5f4e2c3b5e78e_JaffaCakes118 unpack001/out.upx
Files
-
008d0d67ab01350c96f5f4e2c3b5e78e_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 344KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 216KB - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 399KB - Virtual size: 399KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ