Behavioral task
behavioral1
Sample
e2b5a0ff4297d1c955ca537abf5925db_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e2b5a0ff4297d1c955ca537abf5925db_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e2b5a0ff4297d1c955ca537abf5925db_JaffaCakes118
-
Size
233KB
-
MD5
e2b5a0ff4297d1c955ca537abf5925db
-
SHA1
6b29ffaf18f54c1e4e4d897db9fb88df24132d62
-
SHA256
65972bc30721a7d359724c03648ce56471da2d4de24106892aff5d91c66548d0
-
SHA512
c8c1afa1a89903b50a8a4b17997ed8e2dd9c6fc431a51fff7647d5ad1c5a1a7b2f8961267f52576a4cc6b9ca71c6c56c536394b6ac7ff39ac252255dd7f12637
-
SSDEEP
3072:2dikcsYE2ckdEMAD2R41N4b+xBqkniq2dI9QTVSnHcB1fQw+b85wrEc2sK+iXvIw:xsSBJR4wUWdBxAHKFQws85H+yIBu0u
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/out.upx
Files
-
e2b5a0ff4297d1c955ca537abf5925db_JaffaCakes118.exe windows:4 windows x86 arch:x86
Code Sign
19:e4:96:d9:e2:a6:43:55:b0:ba:ed:3a:a9:3f:a3:78Certificate
IssuerCN=root signing authorityNot Before10-08-2021 14:13Not After31-12-2039 23:59SubjectCN=root signing authority61:40:58:34:0d:2f:3e:4c:3f:4f:5a:1f:0a:c3:49:3c:d5:ec:bb:12Signer
Actual PE Digest61:40:58:34:0d:2f:3e:4c:3f:4f:5a:1f:0a:c3:49:3c:d5:ec:bb:12Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 712KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 231KB - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 640KB - Virtual size: 639KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE