Behavioral task
behavioral1
Sample
sbc.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
sbc.exe
Resource
win10v2004-20240508-en
General
-
Target
65c0aec66b1f9caf244f0aafc493f128_JaffaCakes118
-
Size
171KB
-
MD5
65c0aec66b1f9caf244f0aafc493f128
-
SHA1
2c3d7249c1357c54dd3dda8b72bbe8ee99bb782e
-
SHA256
73c57db7addd4146a29bab544586af8e02a076556b933273ce1688a4761324dd
-
SHA512
c56ac9233d7a9bbf9852ab5657f9859cd6054a1155120d4f07d394b40444874e38f942916f2d6ff9a0c99d29e881bb31c2302bf24158e6df0721d4b57bb4a53c
-
SSDEEP
3072:NXd9z6W7Avn/Du0fhMc2cH0KLB1CJ1/7gMN2ehS3JO82t+fC/YjkH79JJYmk:NXd9z6W8DlfhMc27+QJ1/seEiyCckH7C
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/sbc.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/sbc.exe unpack002/out.upx
Files
-
65c0aec66b1f9caf244f0aafc493f128_JaffaCakes118.zip
-
sbc.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 376KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 172KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 340KB - Virtual size: 339KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 147KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE