Behavioral task
behavioral1
Sample
0f3464a242fdfad27b40f1110180943b_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0f3464a242fdfad27b40f1110180943b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0f3464a242fdfad27b40f1110180943b_JaffaCakes118
-
Size
61KB
-
MD5
0f3464a242fdfad27b40f1110180943b
-
SHA1
3d2ab018ce0f0cea94a609e4254e5728e45f7527
-
SHA256
7744a55cb3f7931f218b58480e2c9d84bac02f9b483a6bffd4a4d446ca778d17
-
SHA512
15e755d8cd130566e5fb57a728f99c2b91ecb98c77dbb7ce4fa528e39e768f1df61c3ecfe5546267aa519d1fa92e0f0407b79fee2578e21f6f8dc239136df034
-
SSDEEP
768:GR2+CtDELF4ItC6DJSe2DzAmhK5FDIVMWUdMrCtRyYGpE/erNGnKTqMN7mrDVGB8:yCcFPRuDkMWFDgUNy1pkerYGmHVUq
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 0f3464a242fdfad27b40f1110180943b_JaffaCakes118 unpack001/out.upx
Files
-
0f3464a242fdfad27b40f1110180943b_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 38KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 64KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ