Static task
static1
Behavioral task
behavioral1
Sample
AD.Stream.Recorder.v1.6.Incl.Keymaker-ARN/Keymaker/Keymaker.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
AD.Stream.Recorder.v1.6.Incl.Keymaker-ARN/Keymaker/Keymaker.exe
Resource
win10v2004-20241007-en
General
-
Target
423ed1d424c9d5c53afc7f7536802850_JaffaCakes118
-
Size
102KB
-
MD5
423ed1d424c9d5c53afc7f7536802850
-
SHA1
0e279c7da813da25cfe235cc4cb17027beb71d20
-
SHA256
3c2c349f1a1ed15b5fb8e75754be0da339e584ea70ff0d97e63e2f9f0dd9a885
-
SHA512
e82670bb2fa36916bf9b29e24413d3273a3db38fa52747c4fdaf8fad5ad22efc101026aab68b9ed5b6d6364c98a75955a93182ec75ee0939f7b19f584470ccc4
-
SSDEEP
3072:ggfePbdEklJ5BnQ7x802db6km7opeGvsE:FfejKa5lQd80ebbm7slsE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AD.Stream.Recorder.v1.6.Incl.Keymaker-ARN/Keymaker/Keymaker.exe
Files
-
423ed1d424c9d5c53afc7f7536802850_JaffaCakes118.zip
-
AD.Stream.Recorder.v1.6.Incl.Keymaker-ARN/Keymaker/Keymaker.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
ARN Size: - Virtual size: 284KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ARN Size: 100KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
AD.Stream.Recorder.v1.6.Incl.Keymaker-ARN/arn.nfo
-
AD.Stream.Recorder.v1.6.Incl.Keymaker-ARN/file_id.diz
-
read_me.txt