Behavioral task
behavioral1
Sample
ea54ec6becb6e613a15efbeec7851d38_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ea54ec6becb6e613a15efbeec7851d38_JaffaCakes118.exe
Resource
win10v2004-20240319-en
General
-
Target
ea54ec6becb6e613a15efbeec7851d38_JaffaCakes118
-
Size
211KB
-
MD5
ea54ec6becb6e613a15efbeec7851d38
-
SHA1
83a98ddcf582aa0bd0791873df43fc165d31beb5
-
SHA256
f1cc493ce320004c61fa80c7ba16888424056a8e43a5ddfe68c4c99100c9f1df
-
SHA512
970a6be7a561bea6040ff19127769bb649c9de988cd99e5dbf64fae69864a18ad79e0b9076e8c7e33a9d181f222715b75936c8ee4f38f9f98e5628315e194cc9
-
SSDEEP
3072:Obp+28SseUKHxoCUYLGiS87wIq+XrnuuRL6sOJDwtfTTIHvUweSnNDyURk5FOGK:B28SVUglY87wg3DZtfHWUwBNDyURk
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource ea54ec6becb6e613a15efbeec7851d38_JaffaCakes118 unpack001/out.upx
Files
-
ea54ec6becb6e613a15efbeec7851d38_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 96KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 182KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 88KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ