Behavioral task
behavioral1
Sample
eb563677e23a935a998bbfdfcc610270_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eb563677e23a935a998bbfdfcc610270_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
eb563677e23a935a998bbfdfcc610270_JaffaCakes118
-
Size
884KB
-
MD5
eb563677e23a935a998bbfdfcc610270
-
SHA1
1382183d47983f29c69425173a48a2c6d8174ca6
-
SHA256
89852d74270402df081c4cc8f8a70c7f9ccd850a58aad2363342eecabb084911
-
SHA512
a59ecb36655e6ecdc2ed4a478b260c3693c5b068768b1e68aa8121362c21881c3e320b877cca7a1cfc8569bf537d6666e0f2efb1c147b6bbc348d83789aef776
-
SSDEEP
12288:K/CRs4H2RlNy2ulK2Hb0wiWCSB7MqtFilmH1jH9iSEds6cAUoBo2xH33jDtK6sq2:K/CRsugnD2HIuBMqtFrjNATDtVsqe6I
Malware Config
Signatures
-
Detected Xorist Ransomware 1 IoCs
resource yara_rule sample family_xorist -
Xorist family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb563677e23a935a998bbfdfcc610270_JaffaCakes118
Files
-
eb563677e23a935a998bbfdfcc610270_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 852KB - Virtual size: 852KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE