Behavioral task
behavioral1
Sample
cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118
-
Size
3.4MB
-
MD5
cdcc0ad2446684e736fa5813caee0a57
-
SHA1
21aad2f791e2c12deed221484ff00ed8a0edb799
-
SHA256
6ef09a9d766a9ca209da5fc075de5c3e7152c3f49e88bb2db61e061f0bd2184d
-
SHA512
6d17654a61116fab4b0b1128699dbbf2751d63e78615f822452a9a1ebe62889df401ed1ba795a04535446c86d4b122036f346e8744e6ac15d6e9c8a1240ec6c2
-
SSDEEP
98304:lnbDOSv7J7SvNZZToTcMBailCO3QBKGFqL9z/2MSbB:xOKF7SJToAMU8uBK2qL9ZSF
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118
Files
-
cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 536KB - Virtual size: 576KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 634B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 16B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ