Behavioral task
behavioral1
Sample
d79b92f1166eaef053315c94c8b24a4d_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d79b92f1166eaef053315c94c8b24a4d_JaffaCakes118
-
Size
107KB
-
MD5
d79b92f1166eaef053315c94c8b24a4d
-
SHA1
62d1612c4f9bbdb60324236f0083fa97c64530ae
-
SHA256
f4a48f22b86d2f6d02f91a39c1bbb72bea98ab0495be8c3153392c8c8d44eb34
-
SHA512
38fb3a4642d4357c8871f495b414829f3e58419da9249cba76135caba2e53742c9c305aff1bfb22666bce1c2ce8a20beb25115bd61d2faa773c10f00c49b23e6
-
SSDEEP
3072:lSXHUiHV/0yf8DCHNVC7GXMUP5lfD7to91t4f6FsBhh0JS:lSX0G/0oqUP5/S1tLFsTh0JS
Malware Config
Signatures
-
Parallax family
-
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule sample parallax_rat -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d79b92f1166eaef053315c94c8b24a4d_JaffaCakes118
Files
-
d79b92f1166eaef053315c94c8b24a4d_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 38KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 63KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 670B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE