Behavioral task
behavioral1
Sample
71465e11a009dfd6d80db0d63fa2fd1b_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
71465e11a009dfd6d80db0d63fa2fd1b_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
71465e11a009dfd6d80db0d63fa2fd1b_JaffaCakes118
-
Size
31KB
-
MD5
71465e11a009dfd6d80db0d63fa2fd1b
-
SHA1
5923541e75e7669d8fdf0f2a7a74454793481330
-
SHA256
8fc35f16c6869daa3403ecf0a59f3eb1f6d03f47d12bb6655c360d13542e3e81
-
SHA512
f364302e73805a4f4784a5632c0a49e4d79f0a30f80c5ea58503cdd1edf3d75d41fb42ba4a023a2472511f6265fb1e3e75c92605eed528ef94e0f327606b4fe5
-
SSDEEP
768:3tijFXuTthUzxf6rFwA3Fh9vaDQmIDUu0tiw1j:oF+KKPsQVkBj
Malware Config
Extracted
njrat
0.7d
12d
senior12.ddns.net:6522
b71af024f3fe5ce59b7d8571cfef3323
-
reg_key
b71af024f3fe5ce59b7d8571cfef3323
-
splitter
Y262SUCZ4UJJ
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 71465e11a009dfd6d80db0d63fa2fd1b_JaffaCakes118
Files
-
71465e11a009dfd6d80db0d63fa2fd1b_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ