Static task
static1
Behavioral task
behavioral1
Sample
memento.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
memento.exe
Resource
win10v2004-20240802-en
General
-
Target
b41349379c349efa17844e1bd2205419_JaffaCakes118
-
Size
52KB
-
MD5
b41349379c349efa17844e1bd2205419
-
SHA1
d2fd040273d3f356ebf3ea9cca2d6b1830404d34
-
SHA256
adfcd6a7e0b665754979658442c9870413b76b91e977a36bb4a831c6af20bfd4
-
SHA512
8f033fce16f06a3f8cdfc37b33a6cbfbac2e25eedfe5581d1281bf1a1879859f9cb7211d8372b07d13c55b7d0f3ff26be87023a39fd290f27b707e8563f01d42
-
SSDEEP
1536:QUOkVdlgn7AkOqgHxGVFF5mOkyxZ3mG8pRz:dOkVd+7tOqgHxqh8eZZ8X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/memento.exe
Files
-
b41349379c349efa17844e1bd2205419_JaffaCakes118.zip
-
cns.nfo
-
file_id.diz
-
memento.exe.exe windows:4 windows x86 arch:x86
87bed5a7cba00c7e1f4015f1bdae2183
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
Sections
kkrunchy Size: 48KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
memento.txt