Behavioral task
behavioral1
Sample
compras.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
compras.exe
Resource
win10v2004-20240508-en
General
-
Target
86ccd498a0efc61d3e5f31e5cd998c97_JaffaCakes118
-
Size
4.9MB
-
MD5
86ccd498a0efc61d3e5f31e5cd998c97
-
SHA1
d57bb641f8f98f9be7c994a4dbe04e4ed0d3fe1f
-
SHA256
e829f85318faa6e3b8ef5de54517de186b560d24da42748d347752e195d1af5c
-
SHA512
1c0c4de56aa834338ad6f752a32fc56e212d9de310ea913a2dfe73d2ae01dcb22e579f0520153cfc2a21118af04225f13aea32129435286605416b5ad7d7f367
-
SSDEEP
98304:j6p9DyB3w/9iFeL02pwY5zHlWQMaueDf1YWo4LmbsNtf3fhJDeM92:ji9DGw/9iFqxpwYZlVMaueDyWL3HvF92
Malware Config
Signatures
-
resource yara_rule static1/unpack001/compras.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/compras.exe
Files
-
86ccd498a0efc61d3e5f31e5cd998c97_JaffaCakes118.zip
-
compras.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 21.8MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 53KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE