Behavioral task
behavioral1
Sample
30b8bc5c98056cd25ba0cecde58c93a4_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
30b8bc5c98056cd25ba0cecde58c93a4_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
30b8bc5c98056cd25ba0cecde58c93a4_JaffaCakes118
-
Size
2.9MB
-
MD5
30b8bc5c98056cd25ba0cecde58c93a4
-
SHA1
1fa0211394ccb339847e2fd6b88d8cb597ce2117
-
SHA256
a7c7a5ff2b962c1fd7c35c97c9f267c7a240b32d2cb9eae458c2b0bdcbea88ce
-
SHA512
dc92d5a78eb83c1d822543c28c842e528b3a3c1f063ec12fe15ee352cf67faccbc29265c1f5172280927e88a684399662d2e250e03f362e796952e48193b1fa3
-
SSDEEP
49152:+ij5s4FBXxGDWepwDxQAPYKsUu5cX1wLt6BT3v4sDD+AwQfp7d8k3qmd:DdVnXcp+QKsU22eBOT3v4u+AwCp7yJC
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30b8bc5c98056cd25ba0cecde58c93a4_JaffaCakes118
Files
-
30b8bc5c98056cd25ba0cecde58c93a4_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
Size: 376KB - Virtual size: 924KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.2MB - Virtual size: 18.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 958KB - Virtual size: 964KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE