Behavioral task
behavioral1
Sample
All-Seeing Eye.exe
Resource
win7-20240221-en
General
-
Target
a1e9eb465f33cf37ae93bb209b073dfc_JaffaCakes118
-
Size
3.1MB
-
MD5
a1e9eb465f33cf37ae93bb209b073dfc
-
SHA1
c33bc7bf4932bf6897d3a2f32bc38c05c486138e
-
SHA256
55c2a66c0077af52127f1c367f9928dd0553a8cc6ccadea9bc6226fa1f880aed
-
SHA512
d2347903b57af48e26fe7709720901d5be9f14b9f2a0c31d5bf70c3e1edacc777d27dfc840aeba4e17ad59b1872d466f040652e0e342bc7b8331b17c607e9c20
-
SSDEEP
49152:HHWTcJa1mDh7iK/4fvPQA7m35nvc71QuSongs74R+Vd1doWkMaME+MTEWi:Pem17H/4XPHm39U71songmay/s2E+M5i
Malware Config
Signatures
-
resource yara_rule static1/unpack001/All-Seeing Eye.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/All-Seeing Eye.exe
Files
-
a1e9eb465f33cf37ae93bb209b073dfc_JaffaCakes118.zip
-
All-Seeing Eye.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 85KB - Virtual size: 181KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 519KB - Virtual size: 699KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 914B - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 366B - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 9B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 10KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ