Static task
static1
Behavioral task
behavioral1
Sample
contrails.scr
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
contrails.scr
Resource
win10v2004-20240802-en
General
-
Target
fba7a6edb851f0f7463d703ca91accd5_JaffaCakes118
-
Size
12KB
-
MD5
fba7a6edb851f0f7463d703ca91accd5
-
SHA1
8e5fef78ec7f3df83bacdc76666452097b0116bb
-
SHA256
e920545eb3cd02353b2ac88ad3005ea9dde4f418da00c4de942ff81897041ef7
-
SHA512
3ea91dd21f4e078d8de9bf0abe2667f9e282429129062028baa4b0967d45dc2bb3f07280e0ac1201dd9951dee4644d3a61f396df2efa8474d7465b85c674a188
-
SSDEEP
384:20A+RbNQsY5JbUJswPzIGEHs24w/bY8SLY7:20Aoxwxw7ZEHTSLk
Malware Config
Signatures
Files
-
fba7a6edb851f0f7463d703ca91accd5_JaffaCakes118.zip
-
contrails.scr.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
1d:82:75:42:fc:6d:ac:a9:40:0e:48:da:26:cc:a6:aaCertificate
IssuerCN=Paracite\\PhilNot Before23/08/2019, 03:31Not After22/08/2020, 09:31SubjectCN=Paracite\\Phil42:1c:8a:0d:09:c7:77:86:26:bb:ab:9f:f4:95:9b:6d:54:54:62:35:6a:11:8a:66:32:b3:85:d8:6e:39:99:f9Signer
Actual PE Digest42:1c:8a:0d:09:c7:77:86:26:bb:ab:9f:f4:95:9b:6d:54:54:62:35:6a:11:8a:66:32:b3:85:d8:6e:39:99:f9Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\Users\Phil\Documents\Visual Studio 2010\Projects\3d P_system\3d P_system\obj\Release\3d P_system.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ