Behavioral task
behavioral1
Sample
2cc56a074e1830da63ff3270f727501d_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2cc56a074e1830da63ff3270f727501d_JaffaCakes118.exe
Resource
win10v2004-20231215-en
General
-
Target
2cc56a074e1830da63ff3270f727501d_JaffaCakes118
-
Size
54KB
-
MD5
2cc56a074e1830da63ff3270f727501d
-
SHA1
b93a9e8e31374ecba2a42b2251b41ca2039c9871
-
SHA256
596f41381850269841d2f7f06e93dd83208602ea72f7481a184a23dcb85f8e85
-
SHA512
b45bcea67972dcb71c979b2474ce0c6eede54853e2fc82cd14f688dc9d0ceaa6aa4b7b9b3bc3ffa47a191716d4aecf0d9625b31ce426fa8fa08281f460c222c3
-
SSDEEP
768:3AW0Y/Kxsha9jriFuOlK3Tji4FdGf0WBREhDp5al8:v58jOluTrUnEb5ay
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/900147558809227264/p2mowWjB62_77xZo8JLdXgMLepDcXYcbZ5-Bk6wmk7xKTfcu4J3iotYz4Oc_1INf-Jut
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2cc56a074e1830da63ff3270f727501d_JaffaCakes118
Files
-
2cc56a074e1830da63ff3270f727501d_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ