Behavioral task
behavioral1
Sample
JaffaCakes118_3b9f028b155287eff5b22c50588be224dfa293ecb7d4b94461bcb034fdf45645.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_3b9f028b155287eff5b22c50588be224dfa293ecb7d4b94461bcb034fdf45645
-
Size
7.3MB
-
MD5
1b729315f3fcb22b6b99b81c279daf4d
-
SHA1
3d856820c1271e529e0d6cc974dc9fb2c969dcf0
-
SHA256
3b9f028b155287eff5b22c50588be224dfa293ecb7d4b94461bcb034fdf45645
-
SHA512
b8ba8c99eea65f22022e51d93b5ad3a577f15c2ae1fe476a935e26cfff7bd8038c3661d31a2ec9f2fb1ac2348e5d1434f2dba436c27933275b0fddb8adee03f9
-
SSDEEP
196608:XmEgOzXX16SfEorayWPMemTfjDJExMXuq:XmEHzXFXso/mfmTbdEOXu
Malware Config
Signatures
-
Cryptbot family
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_3b9f028b155287eff5b22c50588be224dfa293ecb7d4b94461bcb034fdf45645
Files
-
JaffaCakes118_3b9f028b155287eff5b22c50588be224dfa293ecb7d4b94461bcb034fdf45645.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 99KB - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 19KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ