sakula | 815b16465b6d6af4eec86e6b94d8a3bf_JaffaCakes118

General

Target
815b16465b6d6af4eec86e6b94d8a3bf_JaffaCakes118
Size 150KB
Sample240801-vvm24a1bmm
SHA256 eca2e9719e1625ffb02dd3acc2d602d4d05a2222a0654c5ce7d6cf5b7b381a1f
MD5 815b16465b6d6af4eec86e6b94d8a3bf
SHA1 b8cd34f26c8222269fc014a8bbbe594c2a839ffb
SHA512 be5ba21d0f8a54cd114ea42ee230c1d6798356487e6a0b074312b4feac917062001363d686b9afbee7282e23fb6bf63014195d0650a3fa0b9810819a4e70136f
SSDEEP 3072:H29DkEGRQixVSjLLJ30BWPOt5dQw+hyuGDInwX:H29qRfVSnt30Bbt+IhDFX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula

Family

C2

Sakula payload 1 IoCs

resource	yara_rule
sample	family_sakula

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
815b16465b6d6af4eec86e6b94d8a3bf_JaffaCakes118

SHA256 eca2e9719e1625ffb02dd3acc2d602d4d05a2222a0654c5ce7d6cf5b7b381a1f
MD5 815b16465b6d6af4eec86e6b94d8a3bf
SHA1 b8cd34f26c8222269fc014a8bbbe594c2a839ffb
SHA512 be5ba21d0f8a54cd114ea42ee230c1d6798356487e6a0b074312b4feac917062001363d686b9afbee7282e23fb6bf63014195d0650a3fa0b9810819a4e70136f
SSDEEP 3072:H29DkEGRQixVSjLLJ30BWPOt5dQw+hyuGDInwX:H29qRfVSnt30Bbt+IhDFX
MD5 SHA1 SHA512 SSDEEP

Minor OS version

0

Major OS version

4

Entry point

18234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths