Behavioral task
behavioral1
Sample
ed50eb7fbcb88c4f2b76d88cc227ce4e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ed50eb7fbcb88c4f2b76d88cc227ce4e_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ed50eb7fbcb88c4f2b76d88cc227ce4e_JaffaCakes118
-
Size
16.9MB
-
MD5
ed50eb7fbcb88c4f2b76d88cc227ce4e
-
SHA1
37fce6d21737ab5b2681de33416a6c6db900e5e0
-
SHA256
0846c3e4f89c4316cb5c8080f5c49d54b8d011051086e8dd968f7ea6845e90dc
-
SHA512
95033a0b192760236c4be36a8869456fe879a5e3dcd836a2a8a3cb37bdafd66e10816fb9c6b4b6f3db44ddb21749c5a73fe66887b2169499aa089f2e024ff2b8
-
SSDEEP
49152:nUP6NzIO9C1tU+1lIO9CV1tU+nIO9CV1tUh1G1tU+1lIO9CVwX:ne6xIOwtUmlIOmtU6IOmtUTOtUmlIOH
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ed50eb7fbcb88c4f2b76d88cc227ce4e_JaffaCakes118
Files
-
ed50eb7fbcb88c4f2b76d88cc227ce4e_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 792KB - Virtual size: 900KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 312KB - Virtual size: 316KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE