C:\Users\halle\Desktop\Jokerz Loader\Jokerz Loader\bin\Debug\Secured\Jokerz Loader.pdb
Behavioral task
behavioral1
Sample
b61f13290912bc35b6a39a193d8f6723_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b61f13290912bc35b6a39a193d8f6723_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
b61f13290912bc35b6a39a193d8f6723_JaffaCakes118
-
Size
109KB
-
MD5
b61f13290912bc35b6a39a193d8f6723
-
SHA1
a05cc4befe3941d16b1115a0bb72498574861b3d
-
SHA256
a1f53810128b9e20f1b066216550d87200769a8a1761128aac94f1f379435ba0
-
SHA512
7b66daa650912ca1bda58fa69bb6ff079e2ad9ebccf6789dc5e5b81f7eedba42aa0d4b0c7ec16132ca705746a22bb426f601de8c24e6b00195f79e6a9544fd47
-
SSDEEP
3072:w0k/OEjRLnObGsQT5nhAcvLiHiD0QEX5wzDNAMYFNm9gx:wVOEj5ObGso5nhniTP5IAlNUg
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b61f13290912bc35b6a39a193d8f6723_JaffaCakes118
Files
-
b61f13290912bc35b6a39a193d8f6723_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ