Behavioral task
behavioral1
Sample
3a998d2d3e89f9faa6049ab5f558dc5c_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
3a998d2d3e89f9faa6049ab5f558dc5c_JaffaCakes118
-
Size
28KB
-
MD5
3a998d2d3e89f9faa6049ab5f558dc5c
-
SHA1
dbe718ca2975f66c1fe71c2e3f90875f3c5dda65
-
SHA256
e17ccf577de45924b8667a25fed7a0bbcf88a0f39b453887a915cacb0dd66761
-
SHA512
5a1ccdc7d794bdc9a09f0d26a3b279c06da8efe7f39dcf50f8018e4730c605998ffee5938a5cba31e806f48aa940f4e861cbd29a360f856f08a59da9338c7c61
-
SSDEEP
384:62+Sbj6NKUSs6/DAt9iXCqDtS7H+ovDKNrCeJE3WNgLOGngyFT3DKSNQro3lcSMQ:npUP6/Dq9GS7H+m45N8//3DKSDj
Malware Config
Extracted
limerat
-
aes_key
25685535
-
antivm
false
-
c2_url
https://pastebin.com/raw/ECrBZ5F2
-
delay
3
-
download_payload
false
-
install
true
-
install_name
Yoooo.exe
-
main_folder
AppData
-
pin_spread
true
-
sub_folder
\Yoooo\
-
usb_spread
true
Signatures
-
Limerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a998d2d3e89f9faa6049ab5f558dc5c_JaffaCakes118
Files
-
3a998d2d3e89f9faa6049ab5f558dc5c_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ