Behavioral task
behavioral1
Sample
4e126c32e79a7f9b50aeb48cf96ed3c8_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4e126c32e79a7f9b50aeb48cf96ed3c8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4e126c32e79a7f9b50aeb48cf96ed3c8_JaffaCakes118
-
Size
125KB
-
MD5
4e126c32e79a7f9b50aeb48cf96ed3c8
-
SHA1
ebc5aadd1b0b846e9efe1aabf50ab8609582cddc
-
SHA256
58267b4c5880d06ec793d3542f3329d6bc69266ce2253fc1f4ff2642ab11b39b
-
SHA512
c20f74a9570c027d89bb8c03f1cb1bbaf421514eaaa2548b60248500844dd1bca19d80ec6c0de14ae913cfb45a4b10ad03cfae1726832c7915eb869807821acd
-
SSDEEP
3072:MFSrT04+t1RTAKzn6zoqJv2wO0xfpRviVSG8C74f:iQ040RTb6ztFdpR44f
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4e126c32e79a7f9b50aeb48cf96ed3c8_JaffaCakes118
Files
-
4e126c32e79a7f9b50aeb48cf96ed3c8_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
Size: 168KB - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 47KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 968KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE