Behavioral task
behavioral1
Sample
fc614c618830f267c8485e3da2b1a1b1_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
fc614c618830f267c8485e3da2b1a1b1_JaffaCakes118
-
Size
2.4MB
-
MD5
fc614c618830f267c8485e3da2b1a1b1
-
SHA1
21116b21749dbfeefb03d88dfb34572e65452556
-
SHA256
11931b6d1c0ab24e232e80661fccb89631874a534c082dfa13dd1f2dec9a9e6a
-
SHA512
6465b830921f1807ee9a8e4d594c161d5419d984a82518053081d459a59e2b37371855a54462ec79eea430896bed73a2dbdf87183870a3f1abbdb503b272f4fd
-
SSDEEP
6144:jWsiQNWHmQkq4Pffnr+pRboC6wXiMol9Wcx82zTyUUviP:a04Hmb+bB6wXBQ8
Malware Config
Signatures
-
SectopRAT payload 1 IoCs
Processes:
resource yara_rule sample family_sectoprat -
Sectoprat family
-
Processes:
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource fc614c618830f267c8485e3da2b1a1b1_JaffaCakes118
Files
-
fc614c618830f267c8485e3da2b1a1b1_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 368KB - Virtual size: 367KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ