Static task
static1
Behavioral task
behavioral1
Sample
Crack/pm.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Crack/pm.exe
Resource
win10v2004-20240508-en
General
-
Target
ab3e6d559f8bc45247f4c595fe68abd5_JaffaCakes118
-
Size
293KB
-
MD5
ab3e6d559f8bc45247f4c595fe68abd5
-
SHA1
81f40f2cf7318a4b9bf1ae5eadbaa0d7cf6ae9bd
-
SHA256
ca2a3cc10a39e77b504e5f7121f6cfec0297377b549fc7b1779158f672b1a768
-
SHA512
e2011d6664d22f1a3d538036b62816bb7f783a51f99fbb40454dd2bf64b48ab15b0f0bfb69f0f9564b15a2210fd85aa0ae7183a276b3ae0a485cfe60b01d8c73
-
SSDEEP
6144:B13ETZBWLgWazp1SqVqt2s2kxko8iKP5Oh7rrz1BgERD4/y+YUryM8:f+7GgWY1SDt2ExTKU35mEC/y+YUryM8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Crack/pm.exe
Files
-
ab3e6d559f8bc45247f4c595fe68abd5_JaffaCakes118.rar
-
Crack/pm.exe.exe windows:4 windows x86 arch:x86
5a498eee87e4d89512a84502f500181f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
Sections
Size: 252KB - Virtual size: 680KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE