Behavioral task
behavioral1
Sample
789245a5aa5857f3b9e38f5355b679dd_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
789245a5aa5857f3b9e38f5355b679dd_JaffaCakes118
-
Size
696KB
-
MD5
789245a5aa5857f3b9e38f5355b679dd
-
SHA1
7d189b671d91ebd5af7d21661c7ab6f72774d914
-
SHA256
9d507cf82cd7b0b8ef00191b630202ea8ecda99e6b4f059c3d4740e0ad616bd8
-
SHA512
0a556d44644e6e8ae3c30590a5616d9ea8596d694c77e71be677168e69af4cdda17f6ec7f2e02faed5b4c37783bd67d49e86de1500fb4510931669e17387f606
-
SSDEEP
12288:lRWGc2WmdIYsG0eDHbA86iNiu+wvRmXKRpnuVFeNSQ1N4fzSEGdnS66l/WBY8zPs:yGddIwf7AO+wcYpnuVs4uCzS5INCY7jx
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 789245a5aa5857f3b9e38f5355b679dd_JaffaCakes118
Files
-
789245a5aa5857f3b9e38f5355b679dd_JaffaCakes118.exe windows:4 windows x86 arch:x86
fdbfec85672f73d2a4d49635454936d4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
user32
MessageBoxA
Sections
Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 928B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 548KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.perplex Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE