Behavioral task
behavioral1
Sample
1a9b56bfb288c007b6d4d85fadb8b183_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
1a9b56bfb288c007b6d4d85fadb8b183_JaffaCakes118
-
Size
1.3MB
-
MD5
1a9b56bfb288c007b6d4d85fadb8b183
-
SHA1
494b8ee67bf0ef2b39696efd00195ac4fbf35430
-
SHA256
1b0bc72089d28ab55c4f4c51bc92173b3a2be21f7bcaa4157447ac4930be7c4a
-
SHA512
75a660e19a56b72fb030a7ce7c3d56d87a077ffdd1521232684b02262d9ac42b2dbc7f5f97dc857b8c4d59cdf5bb76e0b81acd8616e0e30fa24613d9770f68a7
-
SSDEEP
24576:CN4G96RfkkFkRKJkQ8+FSkDa3RnqXsIkEBpj7/w/TPx693/6Lq32CbQRsqrT:CN396JFk1Q8VkmBSsIzBl72Lw9v6LiFe
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1a9b56bfb288c007b6d4d85fadb8b183_JaffaCakes118
Files
-
1a9b56bfb288c007b6d4d85fadb8b183_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 4KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE