KBot
Behavioral task
behavioral1
Sample
5d438b99c3a814790b6b017e0e669331_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
5d438b99c3a814790b6b017e0e669331_JaffaCakes118
-
Size
717KB
-
MD5
5d438b99c3a814790b6b017e0e669331
-
SHA1
e51f71fa51c31ac5db103c6daa48de8201e58304
-
SHA256
c89e0a5c6d791a796e092fad6b19ee35e6d3ba3308890c6c45291a723573dd55
-
SHA512
6573e907441e77476403840e08ee27156ae5fcee31252f93e02167dbaf3b55a2f8419ce68d578b58c493f5a3e1b723744410484a32947f8bbda98a0f381cec68
-
SSDEEP
12288:69pJJZzbFTlsBP8ZB1wj/XtHAmRzDyTUydTOq4jYOBd8as9b5zUN2vVa:0TzUOZYJHAmRzDyCcOqFQN2Na
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d438b99c3a814790b6b017e0e669331_JaffaCakes118
Files
-
5d438b99c3a814790b6b017e0e669331_JaffaCakes118.dll windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
Size: 77KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 628KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE