Behavioral task
behavioral1
Sample
0dc37c096e61daeb6064cb330a0432f6_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0dc37c096e61daeb6064cb330a0432f6_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0dc37c096e61daeb6064cb330a0432f6_JaffaCakes118
-
Size
137KB
-
MD5
0dc37c096e61daeb6064cb330a0432f6
-
SHA1
d7e342dcbe3cdaa24be6b0d6e5bf0c132140b01a
-
SHA256
cfed2427b7a0396d57b1bc6752913882e7a1e4be2c648ba5762ec1a6df74baef
-
SHA512
881d1657c28f8d52ee0840bdea7e222311b5f7b556d85260bc024d388c126df111318caff2e9204f1c3c255ecea0f00d0c8ba395729bab8bb7c9a7d279b6c1be
-
SSDEEP
3072:UV9sE9f+di3Wo786TgsaB7fgpWAThoPdnEe+8FFwjm:UVeEodiZ7BTgsk7UThSdnEnRjm
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 0dc37c096e61daeb6064cb330a0432f6_JaffaCakes118 unpack001/out.upx
Files
-
0dc37c096e61daeb6064cb330a0432f6_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 135KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 9B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 654B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ