Behavioral task
behavioral1
Sample
3f9137d11dc9f3cc23e0cf9446d3dd7e_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3f9137d11dc9f3cc23e0cf9446d3dd7e_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
3f9137d11dc9f3cc23e0cf9446d3dd7e_JaffaCakes118
-
Size
31KB
-
MD5
3f9137d11dc9f3cc23e0cf9446d3dd7e
-
SHA1
8378807bb42d3e1c99e208e52748c682fc717912
-
SHA256
4ea398882bb10bfb96d1e9e81f7a6045b77e7ccaa10bdec1005005682f66b6e7
-
SHA512
4493444f53b5f87888d7081c61c1d3d0916698769eef07736734b35e0aa3a31d2031d13c0f41f740bb417e48bc5fcae4e7ec51903c064ef1e08a703cb86bc187
-
SSDEEP
768:d4/o0kZlH/azx1+tkqqni97vWQQmIDUu0tihsj:A4qmpfQVkvj
Malware Config
Extracted
njrat
0.7d
Me
ggwp90wp.hopto.org:21
a1407421c4ceb708a74b8d0b62444988
-
reg_key
a1407421c4ceb708a74b8d0b62444988
-
splitter
Y262SUCZ4UJJ
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f9137d11dc9f3cc23e0cf9446d3dd7e_JaffaCakes118
Files
-
3f9137d11dc9f3cc23e0cf9446d3dd7e_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ