Behavioral task
behavioral1
Sample
JaffaCakes118_8a6f0874298f1d76b771c31e4c48da18.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_8a6f0874298f1d76b771c31e4c48da18
-
Size
245KB
-
MD5
8a6f0874298f1d76b771c31e4c48da18
-
SHA1
23c9f37aab365b777d701d1223863318f214f9c6
-
SHA256
8bc501d4578a0f509d94dae1537748bfd6e99afa983b3d62ea690f18a9c3611a
-
SHA512
bc2df25fc0bc0139581ba6c01d851ca31c0d611c1805d66c6bb38297b932b8354bdc0d128196d3a45c767dd162cfcc1273d98e55393c17f0a1636a56bc18606f
-
SSDEEP
6144:4OTcK+NrRioGHlz8rz0i/ZzQqqDvFfAgDNPm0ft61mzLpmo1HAxN9orm:4K+Nr8MrYi/7qRogV/ft61mzLpmo1HA5
Malware Config
Signatures
-
NetWire RAT payload 1 IoCs
resource yara_rule sample netwire -
Netwire family
-
Core1 .NET packer 1 IoCs
Detects packer/loader used by .NET malware.
resource yara_rule sample Core1 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_8a6f0874298f1d76b771c31e4c48da18
Files
-
JaffaCakes118_8a6f0874298f1d76b771c31e4c48da18.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 243KB - Virtual size: 242KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ