Static task
static1
Behavioral task
behavioral1
Sample
RYKAWEnpep6RbEt.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
RYKAWEnpep6RbEt.exe
Resource
win10v2004-20240709-en
General
-
Target
6334e22d48264175e362eba0f4de6812_JaffaCakes118
-
Size
462KB
-
MD5
6334e22d48264175e362eba0f4de6812
-
SHA1
4ae50aea624f862aa9b9c7d28f77a95854917644
-
SHA256
0adca1b076ec63f4af9857346b2dd8e986feb2e4e9790b3e4bbfe70495a3399d
-
SHA512
58f1b3600eb37b370e9914e87b0a180154a9bc378941172a09911f34bbacd11523fa80f8dfacbfe5efad9e3a4252ef1f8183110dc9784409c32883067dce9940
-
SSDEEP
12288:/uU87Xnsnlfr2S7BfyrYtyPgFpIc+BZ2Yj6rzz:AXsnlfr2SwYyoFpIFgYGrH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/RYKAWEnpep6RbEt.exe
Files
-
6334e22d48264175e362eba0f4de6812_JaffaCakes118.rar
-
RYKAWEnpep6RbEt.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 516KB - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ