Behavioral task
behavioral1
Sample
JaffaCakes118_e82e07a2f06226989c2864557311d904.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_e82e07a2f06226989c2864557311d904
-
Size
6.3MB
-
MD5
e82e07a2f06226989c2864557311d904
-
SHA1
1b5efe272bcc5fd95f4cae034995fc3b795d3416
-
SHA256
2602948e0301d266cd808c4b9d8bbe75dee0025686b603b2c321d6e97c5f2cc5
-
SHA512
f43124a0f4cff06fb31450dece6d21394a1817b56d50b2988338b1295ea963b9bc9405d4691a926c7179ddb785d67e01f4bfb74044e8fcf2db0f361bbde3f62d
-
SSDEEP
98304:P3c+RXz2LmThcHp5ooEAnHRVN07KgHDpS18DqBRe7qxKfT1J+tNY3LU4rI2qoP:rRfg53HRVu7vHDpS1IqBRU7kCs2q
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_e82e07a2f06226989c2864557311d904
Files
-
JaffaCakes118_e82e07a2f06226989c2864557311d904.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 363KB - Virtual size: 362KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ