Behavioral task
behavioral1
Sample
Delivery.Pdf____________________________________________________________________________________.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Delivery.Pdf____________________________________________________________________________________.exe
Resource
win10v2004-20240226-en
General
-
Target
ec9ec80540dd428a1ac00865271834d9_JaffaCakes118
-
Size
43KB
-
MD5
ec9ec80540dd428a1ac00865271834d9
-
SHA1
2502b8071e14836dd9806c6a149641c9af85f2b7
-
SHA256
ac633dccb8f5db551e98bb7ebe42da3d886dfe7d1733287ba19e1840ba358949
-
SHA512
6e2f96e2e975c2d777b4cce8ccfbcf7d744c8475fbb9049dd99f90d6d03763d6b4fbc4e0e5b6fba61e10549ffd64966918d95810f13521d8583b79986a4e6dcc
-
SSDEEP
768:SBONkuyqWTHNiktLa6J2KB0RDwA8N1egX8ugo1y+tw06hqhlLUVf:SMN9nWRxMKBGkRNXCqHlgVf
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Delivery.Pdf____________________________________________________________________________________.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Delivery.Pdf____________________________________________________________________________________.exe unpack002/out.upx
Files
-
ec9ec80540dd428a1ac00865271834d9_JaffaCakes118.zip
-
Delivery.Pdf____________________________________________________________________________________.exe.exe windows:9 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 80KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 42KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:9 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xdata Size: 512B - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ