36113140e1d0eb7932cca95b27a442899537f551e41a63e68feb1a76c76f7e16

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 16:54

Target

bd9a5491ada8709fac247bcca2f63114_JaffaCakes118.exe
Size

15KB
MD5

bd9a5491ada8709fac247bcca2f63114
SHA1

01c9f4c0bb483bb79049c9925d31fc6a9acf2618
SHA256

36113140e1d0eb7932cca95b27a442899537f551e41a63e68feb1a76c76f7e16
SHA512

8548aa9180135006f06f1947d7ac82e3a88b8a80a969151fc1e2ffceee7e8aff07ddfa16383d9e71014d641b8185761180e1e290dd96f047f45b60232b6b37d4
SSDEEP

384:YQ9h5rTaMlUktE1uE8eBpqgNFHfuoeyPhCiP/QK5tJw41N:Lh5ahkC1xOOBfrCiHf1D1N

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1932-0-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1932-2-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1932	bd9a5491ada8709fac247bcca2f63114_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bd9a5491ada8709fac247bcca2f63114_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bd9a5491ada8709fac247bcca2f63114_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
PID:1932

memory/1932-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1932-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download