Behavioral task
behavioral1
Sample
efba4629d688254fcfa59ba401841c92_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
efba4629d688254fcfa59ba401841c92_JaffaCakes118
-
Size
1.5MB
-
MD5
efba4629d688254fcfa59ba401841c92
-
SHA1
2aa74368193e7e78fc6b37ee8ad29e9c4c3add6e
-
SHA256
7b131b5ca77fd3bf912e75d18f6df35a558abe70065deeaacd56e5939e054959
-
SHA512
d0582bafe8faff07a0612dbe7c6d004a6f8beaac7100a2bf22d6c6eeef47c9f5ed306e610100b7b49e1fc789619176b218919bd793500dab47a0d04791cba7e9
-
SSDEEP
49152:OJxhsWTBwaoWim8W4T+Jm4M2FN+UfMnZC:QGIBwFWQBEm4MMNwnZC
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource efba4629d688254fcfa59ba401841c92_JaffaCakes118
Files
-
efba4629d688254fcfa59ba401841c92_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 218KB - Virtual size: 740KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 1.3MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE