Behavioral task
behavioral1
Sample
c9a892b05f775ddf569b745c6bd95a25_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c9a892b05f775ddf569b745c6bd95a25_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c9a892b05f775ddf569b745c6bd95a25_JaffaCakes118
-
Size
42KB
-
MD5
c9a892b05f775ddf569b745c6bd95a25
-
SHA1
ff709170c90d41ac2413d8a9fa7fbaa1b6e21a06
-
SHA256
5ff7ac25f43858d6962b49f8dce580db4983cdfcc4d635fbd6085c1c90432b44
-
SHA512
513cf5cd3cbea0d5f05774202f755b91432bcdfe093bf6814cdba87fc44c82df40747692483e1f455c37664a4d6f96556bc6f6af64cbcc21489fb70b56344b2d
-
SSDEEP
768:ALz3dxCGO1rtQ7YBluZaLYdTjRKZKfgm3Eh3R:Atxm1r1BVLYdTlF7ExR
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/894002578583597106/mzVkoxw2rfX5M9ZzRYptqhY9Dap8FNvXzNPbMvgAot4FJ0ykAN91BaWshRYDwajmPLcR
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c9a892b05f775ddf569b745c6bd95a25_JaffaCakes118
Files
-
c9a892b05f775ddf569b745c6bd95a25_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ