Behavioral task
behavioral1
Sample
ALG.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ALG.exe
Resource
win10v2004-20240508-en
General
-
Target
78f4d9a55359d65f9ebb630a20954719_JaffaCakes118
-
Size
229KB
-
MD5
78f4d9a55359d65f9ebb630a20954719
-
SHA1
10f06414bbdf6793db819545bfa5beac0924e926
-
SHA256
9fd8f29c29809c40cfe89839f4a3037ca549ed6a15566609dc74a9a7e93c7853
-
SHA512
0c7e97f540a4c7cf4cd8f6d26932fd2379bc5b5b67463eec793b7c468a691169eeccb38d73a2d05b1739d7bfd3ce257104c639c7a34bb466539a589b0bb7eda0
-
SSDEEP
6144:dGqZDSSE55qd2IAzRcSrXLslCjL1k6ZKsm:lZWz8drAzRHrAMNTA9
Malware Config
Signatures
-
resource yara_rule static1/unpack002/ALG.EXE aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/ALG.EXE
Files
-
78f4d9a55359d65f9ebb630a20954719_JaffaCakes118.zip
Password: infected
-
67d53595cb7ac27d7c879ea666e86db6b5d67d3146511be7efaa56e74e9ad6e9.zip
-
ALG User's manual.txt
-
ALG.EXE.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 196KB - Virtual size: 472KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE