C:\Users\Dr-West\AppData\Local\Temporary Projects\????????????????????????????????????????????????????????????\obj\x86\Release\????????????????????????????????????????????????????????????.pdb
Behavioral task
behavioral1
Sample
1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
1febff56b1d084aa07180b1023f74fcf_JaffaCakes118
-
Size
340KB
-
MD5
1febff56b1d084aa07180b1023f74fcf
-
SHA1
b41264792c40e579aee3f322b56ecb02ca25731c
-
SHA256
b189c98026693dc35e6da2e8b54057891aba4f698330af3e40b4b9322e6fb9e8
-
SHA512
7cc5d819265e3ad4cfa882d596d52011ccbee6389fae9551c583633b2721d57e5c57bb7a243a611aa6bf4d7b04dd9778991ac1aedb28c3e0e3b957f8a870c088
-
SSDEEP
6144:QGRQziaMSeIzmO3eFs21iMk2UE0uon7BLL/nA:QGRQzRwUmO3f21beE0uQ5L
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1febff56b1d084aa07180b1023f74fcf_JaffaCakes118
Files
-
1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 335KB - Virtual size: 335KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ