Behavioral task
behavioral1
Sample
663c9a7af8efbdb5ae36289fc881c0c3_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
663c9a7af8efbdb5ae36289fc881c0c3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
663c9a7af8efbdb5ae36289fc881c0c3_JaffaCakes118
-
Size
487KB
-
MD5
663c9a7af8efbdb5ae36289fc881c0c3
-
SHA1
0c8453b6dd379abf826f0b1752e58b154ca45aad
-
SHA256
02c8682f98c3b8fcd5265570d962458cc4fd52a87b1849114c913254068478d5
-
SHA512
78b60b370e688452da8c3c92d9febfeb5f5eaa834089ace5ae03ce04f0d4e88ee725b8340dadf90ef8f5fa43ee86c1132e5ae1880aaed95af530ff8d5a21a15a
-
SSDEEP
12288:vfPEccw1ao4H5WuIcsPVhKa+BsyeV4pmAItpCr:vfJ8X5dsPVhsfeV4IHU
Malware Config
Signatures
-
RevengeRat Executable 1 IoCs
Processes:
resource yara_rule sample revengerat -
Revengerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 663c9a7af8efbdb5ae36289fc881c0c3_JaffaCakes118
Files
-
663c9a7af8efbdb5ae36289fc881c0c3_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.rsrc Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 428KB - Virtual size: 427KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ