Behavioral task
behavioral1
Sample
JaffaCakes118_64504594061b330e27de0aa2f671e2b05c921ad1b8ebdab77016bb8a0b5b391c.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_64504594061b330e27de0aa2f671e2b05c921ad1b8ebdab77016bb8a0b5b391c
-
Size
6.9MB
-
MD5
d0a08b3f79d6da2c0cdc21a2f6806b94
-
SHA1
ab1561cc3002a01a437833ca94848fbca8194481
-
SHA256
64504594061b330e27de0aa2f671e2b05c921ad1b8ebdab77016bb8a0b5b391c
-
SHA512
6678a98ae8206b76685943bfae468e1b2a9bc7eee7c070493ca2fdf009e14bf6a5d6accea5c52902b050a2cf0b4954af0b90e20af9d008f26912f6c2a3dafc55
-
SSDEEP
98304:w/nbzVQSEYQa5pWkPZBUBr2hM+xOgZpxVNSc6fRMteB4N8oFdWR:YLLcOrZp0fetlPFdW
Malware Config
Signatures
-
Cryptbot family
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_64504594061b330e27de0aa2f671e2b05c921ad1b8ebdab77016bb8a0b5b391c
Files
-
JaffaCakes118_64504594061b330e27de0aa2f671e2b05c921ad1b8ebdab77016bb8a0b5b391c.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 99KB - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 19KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ