Behavioral task
behavioral1
Sample
da1e1ac35c8a9f2a0f5dfd4099b592e5_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
da1e1ac35c8a9f2a0f5dfd4099b592e5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
da1e1ac35c8a9f2a0f5dfd4099b592e5_JaffaCakes118
-
Size
317KB
-
MD5
da1e1ac35c8a9f2a0f5dfd4099b592e5
-
SHA1
3c01e1fe8592767a42d5683609e1453a352adc34
-
SHA256
0dcbfa4bca47f2468ae18e0fec7cfc26d298c05b3d042b7787b0edfc7592b8a5
-
SHA512
19e3dc24d1970d036426878864cf660abb2b0e0f722c92d78aa63f46a45f42f9314dbaa9f6d6780cb2650a93a7b7b6b30e6b7ffc832e24aaa9c96e7734c5797e
-
SSDEEP
6144:vfyuEn2FoP1HCkN8cwkwaoL3UHs0+fsC+IzgPqUnp2nJryCVhw:vfPEccw1ao4H5WuIcsPVhw
Malware Config
Signatures
-
RevengeRat Executable 1 IoCs
Processes:
resource yara_rule sample revengerat -
Revengerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource da1e1ac35c8a9f2a0f5dfd4099b592e5_JaffaCakes118
Files
-
da1e1ac35c8a9f2a0f5dfd4099b592e5_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.rsrc Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 428KB - Virtual size: 427KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ