Behavioral task
behavioral1
Sample
3a82723189d647fbddd8cd873db092f2_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
3a82723189d647fbddd8cd873db092f2_JaffaCakes118
-
Size
28KB
-
MD5
3a82723189d647fbddd8cd873db092f2
-
SHA1
5bc7c36acbc90174c3d36ae08144d4fe196f770c
-
SHA256
56a2d4ec33c944d9b53fada5711fc2f126178c215e334e37cc63f2d8e66a410f
-
SHA512
e1c229f922a90e3384fbdf2d0c95163bf7b3e816dbc77524a49db89bdc836d6f1de53c1a9328b0091ce3cb7bc91378ac8eaeade27d82bde32d5dbd5a8acadcc3
-
SSDEEP
768:qp8O6PTwdSxya2645NXnG4NnTUhNBSKYj:qpMTwdK72TrlF4S5
Malware Config
Extracted
limerat
-
aes_key
onecraft
-
antivm
true
-
c2_url
https://pastebin.com/raw/1YzdX58S
-
delay
3
-
download_payload
false
-
install
true
-
install_name
MicrosoftSpeech.exe
-
main_folder
UserProfile
-
pin_spread
false
-
sub_folder
\MicrosoftSpeech\
-
usb_spread
false
Signatures
-
Limerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a82723189d647fbddd8cd873db092f2_JaffaCakes118
Files
-
3a82723189d647fbddd8cd873db092f2_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ