Behavioral task
behavioral1
Sample
a00fb301627569c02a6049948edfa4f4_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
a00fb301627569c02a6049948edfa4f4_JaffaCakes118
-
Size
2.5MB
-
MD5
a00fb301627569c02a6049948edfa4f4
-
SHA1
876cd672502a32f935b3d74c0709c7ab18d007c0
-
SHA256
d067eb6f1e71610b17e8c2f04e4aabc5a8dcac2f45f0f1b7c2e513f8f0aeccef
-
SHA512
fa9778c1b0ef8881b0e6b0c05b48210873b8d329675c947560a23aa74391190e8fac82c379635312fc6a4c070c3f3ec53b82315b2bb0a3d9b3238f77e502fa0d
-
SSDEEP
49152:Q2ZTGLeCbvW9giG81t6wlK2qinPu6cxyo7POaf/K601R:Q2EViZtt0iPu/oo7POx
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource a00fb301627569c02a6049948edfa4f4_JaffaCakes118
Files
-
a00fb301627569c02a6049948edfa4f4_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
Size: 748KB - Virtual size: 748KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 1.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE