C:\Users\Straved\source\repos\LOGIN+BOOST\LOGIN+BOOST\obj\Release\LOGIN+BOOST.pdb
Behavioral task
behavioral1
Sample
49a85395729d2804172f7e8dfc6f76ff_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
49a85395729d2804172f7e8dfc6f76ff_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
49a85395729d2804172f7e8dfc6f76ff_JaffaCakes118
-
Size
414KB
-
MD5
49a85395729d2804172f7e8dfc6f76ff
-
SHA1
fcc2598195dbbb13dfc969cfb73c6c95e23c0d44
-
SHA256
1c50e87ac33d4b6e8c4507a9aef907a092248b52158082fb561f95b397599b42
-
SHA512
1c3bad42904521051dcf6fd3d24899a76695c4ff104150c6b8028b6c8244eeedc63b000f460c8a24bb315a95d681aa5627fd465c4f04fafbb94f28660baea8d2
-
SSDEEP
12288:Fq/iaqdnbPUnfzN3BJn9y6eMvPJq4DTd//o5hnyRIA:ndTUnfZ3X9FBn1EnU
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49a85395729d2804172f7e8dfc6f76ff_JaffaCakes118
Files
-
49a85395729d2804172f7e8dfc6f76ff_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 412KB - Virtual size: 411KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 900B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ