Behavioral task
behavioral1
Sample
JaffaCakes118_409eed418408597f0a962a72084954fc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_409eed418408597f0a962a72084954fc.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_409eed418408597f0a962a72084954fc
-
Size
302KB
-
MD5
409eed418408597f0a962a72084954fc
-
SHA1
138afac3a26afe9ae80c2f4039aa37b683c720a4
-
SHA256
1b8fb7ba5b8df9b78b495cd8bf6dcfa9f2c2788ca14db5f0a8c6f764477e8651
-
SHA512
483cf76c9c59d024491c68bb8678676060e1b375e4b3264aad4a88ef85bb5a300e4210d56d0a3e7677dbf19d101e72b9fd11c8f9a4a91d04234b8fd023eda8a8
-
SSDEEP
6144:vRCiEKbuoRwE5WTrKi4LnqYkmIRZr/sBrD/jk9jtqpa7xjLazT:dbuoF5ErKNqKIt/0bk9jt4aFw
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/899039214799302707/qsWKqfMDHZvpjKdUaLOScVIgdq1amrTWt3H7cYjN7JYAUUvivw72drT90nFEQohSqE7a
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_409eed418408597f0a962a72084954fc
Files
-
JaffaCakes118_409eed418408597f0a962a72084954fc.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ