Behavioral task
behavioral1
Sample
fac25dac84e9fe2ed8cbbcc646ec71e7_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fac25dac84e9fe2ed8cbbcc646ec71e7_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fac25dac84e9fe2ed8cbbcc646ec71e7_JaffaCakes118
-
Size
13KB
-
MD5
fac25dac84e9fe2ed8cbbcc646ec71e7
-
SHA1
d04c2ba1656716b4a1c11092b698b67809736d86
-
SHA256
a054629a517c8238d3613c81f6a4b8f38b132ab225cb10cc6924280b40862404
-
SHA512
b091853104bfc1ace12ad7c9f4e7cb1f00680ab6f14a8c95e6e98a88835d5a2b7cdc0ba6c2f6d31153ea7dd01268fce0e59cdcb7cb321260c171ffdcd7501943
-
SSDEEP
192:yu/hi3spBziWZ91FRMRuVxtqtt6T6EvU7VjxCiX54M6WPqrC/42oq+vLtr9ZCsp6:Hw3spBOWZoSxtscZvU7+iXXsLdAeMT
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource fac25dac84e9fe2ed8cbbcc646ec71e7_JaffaCakes118 unpack001/out.upx
Files
-
fac25dac84e9fe2ed8cbbcc646ec71e7_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
code Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
data Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ