Behavioral task
behavioral1
Sample
JaffaCakes118_5c843791f7a693c418b162ccd993b997.exe
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_5c843791f7a693c418b162ccd993b997
-
Size
6.0MB
-
MD5
5c843791f7a693c418b162ccd993b997
-
SHA1
8d6770ecadac15c9665dcabe2e69b63d62e30a18
-
SHA256
ccd4b2ba4cea6ac4ea648e58cbe9ca9cd48f512a1df7414cad6c9ff602c6c688
-
SHA512
6c773e7c57c9d73fc26b88af8b7a4f5491a28eb3211fbc55b3597f660cc424790b44f054ef131b535509aea079a255e3af58240d65d6e29390be7b7b95ac468e
-
SSDEEP
196608:6vzeNVog53HRVu7vHDpS1IqBRU7kCs2q:8a53xVu7vHhqBa4Cs
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_5c843791f7a693c418b162ccd993b997
Files
-
JaffaCakes118_5c843791f7a693c418b162ccd993b997.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ