Behavioral task
behavioral1
Sample
6bbd7c86f55b85e1d16025ce990ee953_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
6bbd7c86f55b85e1d16025ce990ee953_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
6bbd7c86f55b85e1d16025ce990ee953_JaffaCakes118
-
Size
892KB
-
MD5
6bbd7c86f55b85e1d16025ce990ee953
-
SHA1
cd2c3a907427ba5bfc258a797a79bdaf10ae62a9
-
SHA256
a89ac02def3aab8faa50bdf1548c46a6a06d412a7cf83d85cbc78492fd1384b2
-
SHA512
954f9d61801638c42d252622ddd27a195508aed9505bb9b6b52d8c36f991ac9973a13887c2fbbf8f967fb104b1fa36bc357f1ceb37c6c0e03eefe0b621bdaff7
-
SSDEEP
12288:FptnxJZSAJFT+LLp1ltwIAxs3vq6xGJOpqfWNaTcR4y1cQv:FfZxFiLF1lasy0GkpRNLR4y1cy
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule sample family_ardamax -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6bbd7c86f55b85e1d16025ce990ee953_JaffaCakes118
Files
-
6bbd7c86f55b85e1d16025ce990ee953_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 368KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 300KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE