Static task
static1
Behavioral task
behavioral1
Sample
99e67dde3bce28a49e917b20de23eda6_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
99e67dde3bce28a49e917b20de23eda6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
99e67dde3bce28a49e917b20de23eda6_JaffaCakes118
-
Size
588KB
-
MD5
99e67dde3bce28a49e917b20de23eda6
-
SHA1
f973838b66568fc5f74ff396d6186d1176e0e0fa
-
SHA256
4bfb4ba69396cd0e53407019e30928d4be9257e3b51ed78587123f9a22d23ec5
-
SHA512
b0df60c791b4158c12426a8df133277f11c298d359a3c9b251c6a650da325835621f1673496e877bcebaf631e5640cadacc687cfcaafee18357acb9f6093a793
-
SSDEEP
6144:SijRTKI5/DX85JopCtQVYuCyhdu1urMe0B1Nb3io:S0eI5/DM5Jjq7PKeK1d
Malware Config
Signatures
-
Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
Processes:
resource yara_rule sample beds_protector -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 99e67dde3bce28a49e917b20de23eda6_JaffaCakes118
Files
-
99e67dde3bce28a49e917b20de23eda6_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 296KB - Virtual size: 295KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 291KB - Virtual size: 290KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ