Behavioral task
behavioral1
Sample
0a4c7e28b98b75ed4ff1b53a50d2b239_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0a4c7e28b98b75ed4ff1b53a50d2b239_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0a4c7e28b98b75ed4ff1b53a50d2b239_JaffaCakes118
-
Size
139KB
-
MD5
0a4c7e28b98b75ed4ff1b53a50d2b239
-
SHA1
45b0329af98b9bb1aa6fcf61d05d229adb86902c
-
SHA256
4821b9cd84d5755c2e984487359fe54a7cbd14b2812a8c556d4b1c4600cca9a7
-
SHA512
b61116f02ea271f1d5ccbcea1828dc762c3d3248a7b9abc376685c26b7795ff785168ab141cd4f916035584a4ee4d712a158604c87c8e35eccf99798e85c5165
-
SSDEEP
3072:3JMcbO4ifhbueX4/XF4W+2SG0A6SmvzNWUFZNHpQ9VoL1jA7QfVrizf:acyKeXgV+2SPJL4VoLy70VUf
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
0a4c7e28b98b75ed4ff1b53a50d2b239_JaffaCakes118.exe windows:4 windows x86 arch:x86
Code Sign
4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate
IssuerOU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust NetworkNot Before12/05/1997, 00:00Not After07/01/2004, 23:59SubjectOU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75Certificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before12/12/2001, 00:00Not After06/01/2004, 23:59SubjectCN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.Extended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate
IssuerOU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust NetworkNot Before28/02/2001, 00:00Not After06/01/2004, 23:59SubjectCN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57Certificate
IssuerCN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.Not Before19/11/2002, 00:00Not After19/11/2003, 23:59SubjectCN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
1b:11:ac:86:08:b6:ac:47:af:05:2e:70:d4:19:30:22:42:6f:ee:45Signer
Actual PE Digest1b:11:ac:86:08:b6:ac:47:af:05:2e:70:d4:19:30:22:42:6f:ee:45Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 472KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 129KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE