Static task
static1
Behavioral task
behavioral1
Sample
09a07de5345b099554612e4922d37450_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
09a07de5345b099554612e4922d37450_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
09a07de5345b099554612e4922d37450_JaffaCakes118
-
Size
592KB
-
MD5
09a07de5345b099554612e4922d37450
-
SHA1
b5971123d58587c5e57344395711a2662298481f
-
SHA256
66bf6cab7f0064dff329b60e86480c0d44c51b4ac7cffae493e4944a49c8a7d1
-
SHA512
a4917740ed1fd561e1cdd9ec3cd8fa71d0e981373455e34bc58763c18ec2b78552363ca74e171d9439cb52c30ec1b92ea817dce976e6f7a97beb3959bea01e05
-
SSDEEP
6144:PASFSpGcXX0ptepPGTRRNeUK+Lj7fUokbMR5h5FfRddmFuNa/Gm33QMIq1/QbJnS:PpcX5VGtRNeU7fogRFlGDtQbvFkbOjM
Malware Config
Signatures
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule sample Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule sample MailPassView -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09a07de5345b099554612e4922d37450_JaffaCakes118
Files
-
09a07de5345b099554612e4922d37450_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 587KB - Virtual size: 587KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ