Behavioral task
behavioral1
Sample
eefa6d65ae3c059aeda47da1b1ebe5f3_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
eefa6d65ae3c059aeda47da1b1ebe5f3_JaffaCakes118
-
Size
3.9MB
-
MD5
eefa6d65ae3c059aeda47da1b1ebe5f3
-
SHA1
abda62e405e16966348c7894143054c24452ac8b
-
SHA256
6c1287c0a1d7c8912b6e7eb6588921931e7f5e0b108ed6e87a7fa796bdcc6137
-
SHA512
3ac55072079cb5c1ed3e005f26dfee89fd55c8cbac45c475bf8b79b9340da880b199ddd4802990c87cc5c557c1e49780d303901c7f3c9c3ada66574843a8345b
-
SSDEEP
98304:8xYHAUZD71KzPZS6Wd0PNPoyAb44/jVSV4UpLeNKt3cA:sJUT+Z/OQoyAk4URNeNKxD
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
eefa6d65ae3c059aeda47da1b1ebe5f3_JaffaCakes118.exe windows:4 windows x86 arch:x86
Code Sign
66:39:0f:c1:77:86:d4:a3:42:f0:ee:89:99:6d:65:22Certificate
IssuerCN=Logitech Z-906Not Before03/07/2021, 10:07Not After04/07/2031, 10:07SubjectCN=Logitech Z-9068c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23/10/2020, 00:00Not After22/01/2032, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
1d:3d:48:cf:d6:a3:77:65:42:0a:aa:e0:66:07:e2:47:81:6d:aa:02:7b:e6:5b:c2:5f:72:ed:58:61:b2:c5:f8Signer
Actual PE Digest1d:3d:48:cf:d6:a3:77:65:42:0a:aa:e0:66:07:e2:47:81:6d:aa:02:7b:e6:5b:c2:5f:72:ed:58:61:b2:c5:f8Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 93KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vm_sec Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ