Static task
static1
Behavioral task
behavioral1
Sample
2024-06-13_6dbb76333047c9da19c2288992375e10_jaff.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-13_6dbb76333047c9da19c2288992375e10_jaff.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-13_6dbb76333047c9da19c2288992375e10_jaff
-
Size
1.4MB
-
MD5
6dbb76333047c9da19c2288992375e10
-
SHA1
320c6101ca2f664cae46f7db0ae1189fb23d188b
-
SHA256
a71f3a0210bd6ea2d68e9d15145f41bff892cc49dc0f4ba88752ca91bea611cb
-
SHA512
57db7984c7bc23d37dfa721b9d348ea77f97c929ae00f2cd0f7f7c6084e1830e180d29b469cbb4af2690cf06e8a9feda6e319b0e868c907227827d63cc327fe1
-
SSDEEP
12288:oYWUJdMRyK349FTLRLFZvco7QVoTB6pxli+JCj1rqr7YmoxfhVzap13GK7D9iK1m:RPERFo9FjQV/70+J41rqM5IK
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-13_6dbb76333047c9da19c2288992375e10_jaff
Files
-
2024-06-13_6dbb76333047c9da19c2288992375e10_jaff.exe windows:4 windows x86 arch:x86
90d91bb9b70d0f14547c57cba3a266e5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEndOfFile
SetFilePointer
lstrlenA
GetProcAddress
CreateFileA
GetFileSize
ReadFile
CloseHandle
WriteFile
GetLastError
GetModuleHandleA
FindResourceA
SizeofResource
LoadResource
GetLocaleInfoW
LockResource
GetOEMCP
GetACP
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
MultiByteToWideChar
RtlUnwind
IsBadWritePtr
IsBadReadPtr
HeapValidate
RaiseException
GetTimeZoneInformation
GetSystemTime
GetLocalTime
ExitProcess
TerminateProcess
GetCurrentProcess
DeleteFileA
GetModuleFileNameA
GetCommandLineA
GetVersion
LCMapStringA
LCMapStringW
DebugBreak
GetStdHandle
InterlockedDecrement
OutputDebugStringA
LoadLibraryA
InterlockedIncrement
GetCPInfo
CompareStringA
CompareStringW
HeapAlloc
HeapReAlloc
HeapFree
VirtualFree
VirtualAlloc
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
SetUnhandledExceptionFilter
SetHandleCount
GetFileType
GetStartupInfoA
FlushFileBuffers
SetConsoleCtrlHandler
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
SetEnvironmentVariableA
user32
MessageBoxA
advapi32
CryptReleaseContext
CryptDecrypt
CryptEncrypt
CryptGetKeyParam
CryptGenRandom
CryptSetKeyParam
CryptImportKey
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDeriveKey
CryptGenKey
CryptAcquireContextA
CryptDestroyKey
winhttp
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpQueryHeaders
WinHttpWriteData
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpOpen
WinHttpConnect
WinHttpCloseHandle
WinHttpSetStatusCallback
WinHttpOpenRequest
Sections
.text Size: 708KB - Virtual size: 706KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 600KB - Virtual size: 596KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ