Behavioral task
behavioral1
Sample
e2f3bc838868512291eac5bbec29c7e0_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
e2f3bc838868512291eac5bbec29c7e0_JaffaCakes118
-
Size
283KB
-
MD5
e2f3bc838868512291eac5bbec29c7e0
-
SHA1
952f0f1e866c9a2743c939ff894bbdaf75c6fff3
-
SHA256
c8477d6f4710eabfb19717701b4545baebbafec3605c7eefd3c1c91e403fed1b
-
SHA512
0879ca3966cb08d4ac3dad41ed9fe762888a1c17c2dbe4637295d83b2c533831a288745a1b631d6d0b63a4488134fd26b5714bc9709139584de3d3c81a38a0f2
-
SSDEEP
768:7Gsdq7QJTlbUP3EwomeRih8jLlLDhKDSGU2+rD71SCgEHYr:Ksdq7QgP0ZNWb+XY
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
resource yara_rule sample family_xtremerat -
Xtremerat family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2f3bc838868512291eac5bbec29c7e0_JaffaCakes118
Files
-
e2f3bc838868512291eac5bbec29c7e0_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 256KB - Virtual size: 256KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE