Behavioral task
behavioral1
Sample
129f3c4b96e113f4819f52a5f686bb5e_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
129f3c4b96e113f4819f52a5f686bb5e_JaffaCakes118
-
Size
466KB
-
MD5
129f3c4b96e113f4819f52a5f686bb5e
-
SHA1
b5b48c96bd4a5a5e6aacf93a3c0d143491f26220
-
SHA256
4deb26b02d0cb1644fabde685ff15b704aca8b733072d8d9dbde6bce710b9794
-
SHA512
214731cc984f39f422e02c2238ab8400bbd2358d02ba11139a3eecc019a3199edd0b15b8c9201d0126e1a95b170bc3bb142cec324d2786422b53735a9a7a4162
-
SSDEEP
6144:NKLOgsgomKLEFESGz0SPpeEPkPDPrzgtRY5RdrHc13FG9ItU6GvPwu:AOgwmisETzuaeDPvjJ81VGqK6GvPZ
Malware Config
Signatures
-
Urelas family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 129f3c4b96e113f4819f52a5f686bb5e_JaffaCakes118
Files
-
129f3c4b96e113f4819f52a5f686bb5e_JaffaCakes118.exe windows:5 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 185KB - Virtual size: 212KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE