Static task
static1
Behavioral task
behavioral1
Sample
3722/RainbowSixSIEGE+5Tr-LNG.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3722/RainbowSixSIEGE+5Tr-LNG.exe
Resource
win10v2004-20240419-en
General
-
Target
0cffc00195c86bcdc046f9c087041c6f_JaffaCakes118
-
Size
1.9MB
-
MD5
0cffc00195c86bcdc046f9c087041c6f
-
SHA1
b2fc6b007545c670b993695c572f1c457c68ed47
-
SHA256
9679df246f84fda5d0c9517597ee08d02ecf421be4b2f81cbff3757ea4abf479
-
SHA512
847a98517494aafe79d19001cf7d57b4b631c169faf9a415e60785282c6c10cdc355f1d4dbf9a2c46b0284ed448c0f5641c77f6b5b2c71bb9e89d9d0e5bb9143
-
SSDEEP
49152:XY7bH2NuajkY25MXJt/iIPtfaq1xKz2Hdtf6Wr2ewaHrReRwn:XYv2NuajkDML6IP1aqvw2HdkWtD9e2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/3722/RainbowSixSIEGE+5Tr-LNG.exe
Files
-
0cffc00195c86bcdc046f9c087041c6f_JaffaCakes118.rar
-
3722/RainbowSixSIEGE+5Tr-LNG - INFO.txt
-
3722/RainbowSixSIEGE+5Tr-LNG.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
3722/VERY IMPORTANT!.txt