Behavioral task
behavioral1
Sample
d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118
-
Size
66KB
-
MD5
d1cfc7d645f1480a458deab931d69c9b
-
SHA1
d0f2513dbae79c174f94aad30a7f468c944f8d65
-
SHA256
809ead42b86ac24d93896af74f2df781ff40e2157e33d47912202fe95510cc64
-
SHA512
d4365ffc48cfa1fd9c89f1899d192a2ad7b3539c0c30f93d9e35df6730284ec1b725485ca0d370abe83c9b387a638d7ccaf07ea8ba95a41ac8b4b05c70625b2f
-
SSDEEP
768:j0FmBkpKjPYpiMQyfErDvh66fNAcnFEVm3kxq4ucJaYnpIs4KbRRPM5vEvv31fal:jOhrt8rrs6fN2sUcYas4icst2QOaJK
Malware Config
Signatures
-
Detected Xorist Ransomware 1 IoCs
resource yara_rule sample family_xorist -
Xorist family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118
Files
-
d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe .js windows:4 windows x86 arch:x86 polyglot
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE