Behavioral task
behavioral1
Sample
JaffaCakes118_df5ebbad9519fa2798d3b51475d41c4938d1f44e9a8da641309439d70ebca49e.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_df5ebbad9519fa2798d3b51475d41c4938d1f44e9a8da641309439d70ebca49e
-
Size
360KB
-
MD5
d6e41628c299e5a2304c98afb44a395e
-
SHA1
bceae45ec34d6b9e4d5aef2fcf123a9e95576107
-
SHA256
df5ebbad9519fa2798d3b51475d41c4938d1f44e9a8da641309439d70ebca49e
-
SHA512
56d4d84354dc072d0fe9e5f87fc20fb008f7c01de608cf1d518e4cf121f3529f42337f1a0d51af4a70541c7cecec2053e9e1230494f1bb8d8441e544bbc02543
-
SSDEEP
6144:xGTt0vRMwEStKSVkn5hb7u4Ut2FHigrCBAYNDj6JSLH3:0t0vRMwEStS5VKuZJYmSj
Malware Config
Signatures
-
Njrat family
-
Core1 .NET packer 1 IoCs
Detects packer/loader used by .NET malware.
resource yara_rule sample Core1 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_df5ebbad9519fa2798d3b51475d41c4938d1f44e9a8da641309439d70ebca49e
Files
-
JaffaCakes118_df5ebbad9519fa2798d3b51475d41c4938d1f44e9a8da641309439d70ebca49e.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 234KB - Virtual size: 233KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ