Behavioral task
behavioral1
Sample
JaffaCakes118_5cc235bca992542d2a9f412e32cdd196.exe
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_5cc235bca992542d2a9f412e32cdd196
-
Size
1.2MB
-
MD5
5cc235bca992542d2a9f412e32cdd196
-
SHA1
554595bcc147b930f072508c99bad03d56f596d1
-
SHA256
dad97f307f734fde769cdd8c471193bb2c7e3c8101e8c6af95e6635cc58d3868
-
SHA512
8dee4b1fe1c2af90c3fb7b3a2f6944a156b51c36679843ad959b5227b8582c852f57304f6bf2a06c70ea1243a4fc6245ede126b070001b347ba46b703dc9ff57
-
SSDEEP
12288:QZ47sidAz4J1l+1Ax7olDAvE6wN7pug/6nA99vM6Pphf0y/yrsaMJcR/V0:Q2LdG4J14qx0lPrYA9tM6PphfF4sId0
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_5cc235bca992542d2a9f412e32cdd196
Files
-
JaffaCakes118_5cc235bca992542d2a9f412e32cdd196.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 862KB - Virtual size: 861KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 363KB - Virtual size: 362KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ