Behavioral task
behavioral1
Sample
3cae98f72f7c54eb868a5e000fdd58ff_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
3cae98f72f7c54eb868a5e000fdd58ff_JaffaCakes118
-
Size
3.4MB
-
MD5
3cae98f72f7c54eb868a5e000fdd58ff
-
SHA1
8c2f20931d81d74d89c440f1b4716678bf9159e8
-
SHA256
77955a774395ca75cf1ace7c40fe3f22e3631311edae2ea4770a7c7d72703a2e
-
SHA512
6ec375487d2d800e00a3965ab2033ddb8e4bd0d80f78571a57a9ac1c0d3b6e5f1833448274f2259f0c7c64592a765925c7e4198cf21b1787ae5ccbab7ea9b60e
-
SSDEEP
49152:4eDcLen7jmYy28FPMXku9aok36cdUIMbrjQFoTeGTrEhPfQAqQxjHNE:GLe7a2IQap5UegHHsQFQtN
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 3cae98f72f7c54eb868a5e000fdd58ff_JaffaCakes118
Files
-
3cae98f72f7c54eb868a5e000fdd58ff_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 86KB - Virtual size: 216KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Intel Co Size: 437KB - Virtual size: 437KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Intel Co Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Intel Co Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 437KB - Virtual size: 437KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ