Behavioral task
behavioral1
Sample
f6c7094a8d1a917f7375de9f466f6afb_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f6c7094a8d1a917f7375de9f466f6afb_JaffaCakes118
-
Size
3.0MB
-
MD5
f6c7094a8d1a917f7375de9f466f6afb
-
SHA1
9c0077b6543b975dbf3d52a3134a208713577843
-
SHA256
3e77eb721848c685f2910aee6a00042d95ddcfb7da721cc61bf7b269857645a7
-
SHA512
5c74b7fe6d998fe957c381350e830e507779ab1ec12c147ba8e9d7d86ae3b51cfecba8e6c0b405435d3d9af3968efff71f04161a39e51d2e141612cc41573989
-
SSDEEP
49152:0/C3wFiqtFZ/xA7rROY8geWF6aBmq1EyYl/CRScoN5tCCGTPEu9LDKI:iCaBy74Y8mFD1EyYl/FNzLGou9LmI
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6c7094a8d1a917f7375de9f466f6afb_JaffaCakes118
Files
-
f6c7094a8d1a917f7375de9f466f6afb_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 111KB - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 794KB - Virtual size: 793KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ