DllUnregisterServer
Behavioral task
behavioral1
Sample
50941e4a6f6129d5ee4efb21c8b1b3d6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
50941e4a6f6129d5ee4efb21c8b1b3d6_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
50941e4a6f6129d5ee4efb21c8b1b3d6_JaffaCakes118
-
Size
212KB
-
MD5
50941e4a6f6129d5ee4efb21c8b1b3d6
-
SHA1
747b1a0155d73afa38e826d9b7fbfa54ed8a2872
-
SHA256
6532d36b79709920348ba770c19ec8b1f4b670453ae1f11041e71aaa7eae8f22
-
SHA512
ea0aad6ac5b233be4f93ddaef53ac1fc9478cb68f454d13e0ff4523d7296047dde84a49b48e094e24cc41b5f738c3bf5ce637e7ca615666d2b9b75685dcbe2fd
-
SSDEEP
6144:CrQ+yRT2oGCQF2KBOwCn9DIJDlssdW5Our:xN2oGCQAKBOwCn1IJDlsTV
Malware Config
Extracted
dridex
40400
132.255.244.130:443
111.67.77.202:3389
198.50.236.57:443
45.122.223.13:8443
Signatures
-
Dridex family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 50941e4a6f6129d5ee4efb21c8b1b3d6_JaffaCakes118
Files
-
50941e4a6f6129d5ee4efb21c8b1b3d6_JaffaCakes118.exe windows:5 windows x86 arch:x86
eb76140cc31cd615e218e51dbcad0a7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeConsole
ExitProcess
GetComputerNameW
AddVectoredExceptionHandler
OutputDebugStringW
Sleep
advapi32
GetUserNameW
Exports
Exports
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 48KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ