Behavioral task
behavioral1
Sample
d58c2551b08278017175837de41fa2f8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d58c2551b08278017175837de41fa2f8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d58c2551b08278017175837de41fa2f8_JaffaCakes118
-
Size
37KB
-
MD5
d58c2551b08278017175837de41fa2f8
-
SHA1
ead9a962150c76f83c5923ac991b97278b7b78f7
-
SHA256
6f42fed72d035eba81d52fa01f2cb8443594438e95774fd22c4a9b154c7027aa
-
SHA512
6fcf497f7c411b424a08059c8854e6956064a31c648c0eb0ff0070fbc9f9ef4a7818c904190b4cb0f4afe8a8b8acb7126b7ba0acccc834094d9497de0143dc5e
-
SSDEEP
384:VvdCKMizd3jnBhFbJ8ycPj93tRwympwrAF+rMRTyN/0L+EcoinblneHQM3epzXZa:HCg3lLJfcPj9XNmSrM+rMRa8NuH141t
Malware Config
Extracted
njrat
im523
микро
176.103.58.151:6666
f06bcc7f370f2e2af9ce67492f3f1883
-
reg_key
f06bcc7f370f2e2af9ce67492f3f1883
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d58c2551b08278017175837de41fa2f8_JaffaCakes118
Files
-
d58c2551b08278017175837de41fa2f8_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ