Behavioral task
behavioral1
Sample
f26c0501d57c8769db7cff44a43f5ba0_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f26c0501d57c8769db7cff44a43f5ba0_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f26c0501d57c8769db7cff44a43f5ba0_JaffaCakes118
-
Size
13KB
-
MD5
f26c0501d57c8769db7cff44a43f5ba0
-
SHA1
2f9fda2ca262861ca3549abadba2f1b5ccf844df
-
SHA256
9eba0970b7d232802085e961ffe83cab15e268fa5be5c5837628dcf94cc6ced5
-
SHA512
c64a79accdd0ac4ca7caeddcddb8760a9b5ee917a77dad5a0d21a9bf8d0e0bc52b132cb29ef24fc2a9b86eaa7851ad3bf87b73a625a454167467792b1ccc8279
-
SSDEEP
192:yu/hi3spBziWZ91FRMRuVxtqtt6T6EvU7VjxCiX54M6WPqrC/42oq+vLtr9ZCsp4:Hw3spBOWZoSxtscZvU7+iXXsLdAeMJ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource f26c0501d57c8769db7cff44a43f5ba0_JaffaCakes118 unpack001/out.upx
Files
-
f26c0501d57c8769db7cff44a43f5ba0_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
code Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
data Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ