Behavioral task
behavioral1
Sample
c68188c256ab51df7d8804d7a105c505_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c68188c256ab51df7d8804d7a105c505_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Errors
General
-
Target
c68188c256ab51df7d8804d7a105c505_JaffaCakes118
-
Size
316KB
-
MD5
c68188c256ab51df7d8804d7a105c505
-
SHA1
d2395b730b7615e928c943bfa2eedbee5787bdc3
-
SHA256
4ab2ffad7fb7d386894a2eefc22cc686bfc9cdac38d2b530d3aefe6eb60c206c
-
SHA512
6b832c1f3d1fbe5db4c52eaf6835567c4bfa73af14344c3c3bbb43a48d2736d508af47fadbb6e815e99e47406e0335052695f74a81184e20351bd6b965e45202
-
SSDEEP
6144:ffYWAw9fORH/2+bGqUT8HcmQn2ikMpvGUdmwIXo+M9VQHDQyspAkLKMxt:fHJ9fOJ4F23MpvGUNuMXQ8ysHXt
Malware Config
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c68188c256ab51df7d8804d7a105c505_JaffaCakes118
Files
-
c68188c256ab51df7d8804d7a105c505_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gjgc2 Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ