Behavioral task
behavioral1
Sample
xf-adsk2016_x64.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
xf-adsk2016_x64.exe
Resource
win10v2004-20240419-en
General
-
Target
1f5febc72cff96f60e30538b71aa18c7_JaffaCakes118
-
Size
298KB
-
MD5
1f5febc72cff96f60e30538b71aa18c7
-
SHA1
8a24c30fa71a3db40bc7239631a03f0fe5188c3c
-
SHA256
5513fa22661bf783d065f8bdc05ca219b47a9622a06a7cb760b0c31df32d8855
-
SHA512
f2d448d98c714606f50fb19884fd4605a6c2009af03713ac6909693d7c3acb192b55a8ade9389d58ffa0cd4a026d34f87b09a238e5c01c725ef6c448f8de20d7
-
SSDEEP
6144:R5bHSpernphAzA4TBCF10OMst1aRNFVVrhDwKOgF6jOZaOBe9:RJ7nphAzntCr0zst43vVd3AiZa4e9
Malware Config
Signatures
-
resource yara_rule static1/unpack001/xf-adsk2016_x64.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/xf-adsk2016_x64.exe
Files
-
1f5febc72cff96f60e30538b71aa18c7_JaffaCakes118.7z
-
xf-adsk2016_x64.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 592KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 290KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE