Behavioral task
behavioral1
Sample
ff0ccbbb7f0248c3a200564f62d4fa7f_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
ff0ccbbb7f0248c3a200564f62d4fa7f_JaffaCakes118
-
Size
3.4MB
-
MD5
ff0ccbbb7f0248c3a200564f62d4fa7f
-
SHA1
0bc9357203f4b3f159b6b879ee2ad900c3ccb5ad
-
SHA256
ebfce0393e93556a94f80a6f742b4856edb29dcbd9f1f83a5658e0dbdf66559c
-
SHA512
bb96f9c70faec1372c0919636cb64e1adde600650205090b96d4c24d6842d40db9798af8834ea12999ed6ab5d8dc9f95abb39f77c8dbc62b57b7539b8fa7369d
-
SSDEEP
98304:xh1aNuxB5kwT0gahaiiyOEFDWUlgBZ+zzpdBaqQN/pxYQT:tFkw6BOiaeW
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff0ccbbb7f0248c3a200564f62d4fa7f_JaffaCakes118
Files
-
ff0ccbbb7f0248c3a200564f62d4fa7f_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 324KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 20KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 15B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.taggant Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ