Behavioral task
behavioral1
Sample
f354530a499a1fa8bd988253e16f3f1d_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
f354530a499a1fa8bd988253e16f3f1d_JaffaCakes118
-
Size
328KB
-
MD5
f354530a499a1fa8bd988253e16f3f1d
-
SHA1
ac99cbb7ddcc51c3a05d83b8a6a29d8dd83283b5
-
SHA256
ed32c74397f0db5108f589fd0c253bdc9a8f0e30a86cb4c868e45b9ebc5d65ac
-
SHA512
c4bfe9eb4da20cf0bbf9e949e584ecd54bc3dcd90a557ba678f3cbef6282955fb88836ced64cf4886e184d8712aa2d3299e0a2faf8d314b2d730d98a7cc48d71
-
SSDEEP
6144:hjCDcp+tffoycg8bQoRhYTXnyO3Qz/2yczRmzDO:VCDPFCp8z/3Q/lrzC
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule sample family_ardamax -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f354530a499a1fa8bd988253e16f3f1d_JaffaCakes118
Files
-
f354530a499a1fa8bd988253e16f3f1d_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.AntiDot Size: - Virtual size: 44KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AntiDot Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AntiDot Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.topo0 Size: 512B - Virtual size: 55B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.topo1 Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE