Behavioral task
behavioral1
Sample
Posicoes-Na-Cama.exe
Resource
win7-20240903-en
General
-
Target
182262031ec74aa276d64afaaef6abbb_JaffaCakes118
-
Size
643KB
-
MD5
182262031ec74aa276d64afaaef6abbb
-
SHA1
200337506bb6e9cec5857a034d56f82b5127a4d1
-
SHA256
530e1ec6fddfbb7930c81f96f732f3360de96c69ed7d780bba6b054771908e48
-
SHA512
2fb84894c68d9a4213e65b841ad0e4f501e5220d247eb7035e235665a51ad56a75f35472442718da85495443fbeccf5828571d005468a2a1e09572ea365c8159
-
SSDEEP
12288:DG7WJRB3e++G8yScBX92fR5JWUiiptgmqnW7+ACFnfSwHuK6VdKR1xf2:DdJRBu++HyT2LJ6iAmIW7/RauBVc4
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Posicoes-Na-Cama.bat themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Posicoes-Na-Cama.bat
Files
-
182262031ec74aa276d64afaaef6abbb_JaffaCakes118.rar
-
Posicoes-Na-Cama.bat.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
Size: 20KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 627KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE