C:\Users\Dr-West\AppData\Local\Temporary Projects\????????????????????????????????????????????????????????????\obj\x86\Release\????????????????????????????????????????????????????????????.pdb
Behavioral task
behavioral1
Sample
5e274b02a6a66aaf488097b75367da04_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5e274b02a6a66aaf488097b75367da04_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
5e274b02a6a66aaf488097b75367da04_JaffaCakes118
-
Size
368KB
-
MD5
5e274b02a6a66aaf488097b75367da04
-
SHA1
0f09806ff283a4d3316a6056de0bfc1f7c4b2150
-
SHA256
72876b39c5e46f6dfc20fd4e3ee145a6712c624e01303b19db2088fb67a8b406
-
SHA512
a284bf41ac9d8aa501609efb3e174a7a7310761c52751d011a5cd28e0f43a98f9543ee63642e35bb5e1482f4b1fddfefcf52c40209139ffe50ae88ab38069b94
-
SSDEEP
6144:eRVMboQziaMSeIzmO3eFs21iMk2UE0uoO7BLL/nA:eEboQzRwUmO3f21beE0uN5L
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e274b02a6a66aaf488097b75367da04_JaffaCakes118
Files
-
5e274b02a6a66aaf488097b75367da04_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 363KB - Virtual size: 363KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ