Static task
static1
Behavioral task
behavioral1
Sample
0881f40fb13ffc1dd96807fb5565e121a123f581e3080da2a8f9c0c84de2e485.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0881f40fb13ffc1dd96807fb5565e121a123f581e3080da2a8f9c0c84de2e485.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_1eca635bfe07ba452cb84215f82e87598ef16dc8af537bf3c42598a05090b3f3
-
Size
501KB
-
MD5
e8d33ad2b7ac32553f1f3e2ad68384e3
-
SHA1
36f5916a41c679f55308b53531da64b2c55ebabe
-
SHA256
1eca635bfe07ba452cb84215f82e87598ef16dc8af537bf3c42598a05090b3f3
-
SHA512
597454b4ef44215057f866fb978cf9dfd98470a1c520882b27746d4e5364495f925223b71fe3bb7be098f26027425290dad621f6d407addd8120843942b62bc4
-
SSDEEP
12288:GI2mVvSgb9RnbYei1n5/zcoMLnkEUEEoUM4ovRmYVsD31Cdwty:z3jnVi1nZzcoMLnTEDAZmYVsD3EX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/0881f40fb13ffc1dd96807fb5565e121a123f581e3080da2a8f9c0c84de2e485
Files
-
JaffaCakes118_1eca635bfe07ba452cb84215f82e87598ef16dc8af537bf3c42598a05090b3f3.zip
Password: infected
-
0881f40fb13ffc1dd96807fb5565e121a123f581e3080da2a8f9c0c84de2e485.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 556KB - Virtual size: 555KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ