Behavioral task
behavioral1
Sample
07fdb8d6d0704d6e8b35c756e65f2812_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
07fdb8d6d0704d6e8b35c756e65f2812_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
07fdb8d6d0704d6e8b35c756e65f2812_JaffaCakes118
-
Size
93KB
-
MD5
07fdb8d6d0704d6e8b35c756e65f2812
-
SHA1
d6f581f0d098759ed6edd1a2e1f4e2c5a0eac1df
-
SHA256
cd8aa3719c5bf61b01156f9c5118c06052b639201d2181912db433681d8d683d
-
SHA512
1c9ce4ed8c791466d3bdb950841f7d1ddba89a5410c48407871f77f936b1ab6c5d980e6b4d30999bbbc55b95259c31343ee6055dc58643049154a92e6a709f6c
-
SSDEEP
1536:o6WONh+VSFzS6TYdYNq/WMMQphoozGCCAUpVFjTH6Ui0gXlv+gbZzvKIojbOpkm:VWONh+V0zTMoq5MQphFGvehR+gl7KIW0
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 07fdb8d6d0704d6e8b35c756e65f2812_JaffaCakes118 unpack001/out.upx
Files
-
07fdb8d6d0704d6e8b35c756e65f2812_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 252KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 89KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 328KB - Virtual size: 326KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ