Static task
static1
Behavioral task
behavioral1
Sample
3c14204e5dfd970b38c3852aaf1ec689_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3c14204e5dfd970b38c3852aaf1ec689_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3c14204e5dfd970b38c3852aaf1ec689_JaffaCakes118
-
Size
222KB
-
MD5
3c14204e5dfd970b38c3852aaf1ec689
-
SHA1
1eae6bd73d69e7aea52ac99ae8af0ff0d838d4b6
-
SHA256
ffe89578bdd9b5913c5f249a2c275c616dae953b8f7f20c60a014679564ffcd4
-
SHA512
75720ac3609436979e7026806b6a510fcfbf6b94b97a0d5d5e3b59b20dcbd4a160e3ae7b2c339812d64edc1f29583947453fbe70d7ef8c40ecbccd595e33d3ec
-
SSDEEP
6144:WYZe+MXkeWYD8KjE83B5bn4U2pfo5xIlxW95:be+MXkeWmdzz32No/I7y5
Malware Config
Signatures
-
Molebox Virtualization software 1 IoCs
Detects file using Molebox Virtualization software.
resource yara_rule sample molebox -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c14204e5dfd970b38c3852aaf1ec689_JaffaCakes118
Files
-
3c14204e5dfd970b38c3852aaf1ec689_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 95KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 2KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ