Behavioral task
behavioral1
Sample
ff103135e12c74ca79e59821894c4226_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
ff103135e12c74ca79e59821894c4226_JaffaCakes118
-
Size
2.4MB
-
MD5
ff103135e12c74ca79e59821894c4226
-
SHA1
d518da96f82d577249fe3fa668d2a53ee203925b
-
SHA256
b90d014c40d5d6863a8be26e6d4b9e8cfeefc7b077e4bf95dc29dcbab3b233ab
-
SHA512
9b611628ba320a664149a66547fd6cc61b3e706694d5e84ada3e33adb77030c0193500c98e20ad50f55cfc5136ec1ab3112ac5afd6ef8d2bdea52c102f6deab7
-
SSDEEP
49152:mgvyiOhxxDWXROHRox1YCJu0J83PWgOEje2JqHlUwhK15ES7rP:mEAh/D/yrPlJquMek+lUVTP
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff103135e12c74ca79e59821894c4226_JaffaCakes118
Files
-
ff103135e12c74ca79e59821894c4226_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
Size: 12KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 42KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE