Behavioral task
behavioral1
Sample
09e4a2d1ae0cde3684b03d6d3f874c07_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
09e4a2d1ae0cde3684b03d6d3f874c07_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
09e4a2d1ae0cde3684b03d6d3f874c07_JaffaCakes118
-
Size
438KB
-
MD5
09e4a2d1ae0cde3684b03d6d3f874c07
-
SHA1
f31f2b4c338c3a98fa8896ecf4a3e46643ff7ac1
-
SHA256
d23781d57aab9c18d7d0f6fe4452c1fb27b440b8b7ebd450a14b54d82c1ae0a3
-
SHA512
fa4e9f870667b89afc81130aa1d2b9291465d2c1074634c164e14f725d44ac54a6da4c18cc0bb978ed2a83c9dd9004e99d8188183179952c980e385a2423c3f7
-
SSDEEP
6144:ElZ/zUMu4pDSxsCMRzf7x3SfS1JAzXBtL76lo6TgguuT0eB+C6r7n4kW:EHLUMuiv9RgfSjAzRtyoCgSr
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 09e4a2d1ae0cde3684b03d6d3f874c07_JaffaCakes118 unpack001/out.upx
Files
-
09e4a2d1ae0cde3684b03d6d3f874c07_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 444KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 251KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 495KB - Virtual size: 495KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ