Behavioral task
behavioral1
Sample
e272a62e0d06d932f468633f06f8e7fe_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
e272a62e0d06d932f468633f06f8e7fe_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
e272a62e0d06d932f468633f06f8e7fe_JaffaCakes118
-
Size
96KB
-
MD5
e272a62e0d06d932f468633f06f8e7fe
-
SHA1
bb18117b81a9eeae2d98d9879d0e2815d55f60a5
-
SHA256
fa222c6050114c48d50b05f27d8dbe5996db9cf65382283ee27a0858c180ef9e
-
SHA512
76c2a7d77de8f8e2e0a1132da363752ae9e50fb33b44588a4b9525d185182504359a644c24b7d594b8aa26d452f514a32bb2b62629c6c42e900e16606780814e
-
SSDEEP
1536:sP0GfQ/iVwzzXZCKWDpHStgR1rtfPAlcBLvJSZLNoEJ5o9v/EX4i0lSrsZ:s0GfWigzXtWDMWT5Xbv+LNrJm9v/E5fY
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule sample family_kpot -
Kpot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e272a62e0d06d932f468633f06f8e7fe_JaffaCakes118
Files
-
e272a62e0d06d932f468633f06f8e7fe_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ