Behavioral task
behavioral1
Sample
0e663a2a7ebc2ba934cb378f1a2557c2_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0e663a2a7ebc2ba934cb378f1a2557c2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0e663a2a7ebc2ba934cb378f1a2557c2_JaffaCakes118
-
Size
115KB
-
MD5
0e663a2a7ebc2ba934cb378f1a2557c2
-
SHA1
06678a275f86091a1c9845854bccac9a3e4a7639
-
SHA256
c5503438834cfe0a0758532bb46725a80bf0cde3f6bbcd07cf0bff76d4254617
-
SHA512
b4ede529a176ae625fcb31f54b2945e0d351b9c25aeeecaed831c8e128d50b74b28b6d56ef154d0dc1e00daffc5e8d7453272dcf1c7ec887fdf2930b07ded2df
-
SSDEEP
3072:n8OSHvvQa3Vw1Fph4gvL36ZkXJeq9MBv:nbeXz3Vw1Fpywj6KXJeq+v
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 0e663a2a7ebc2ba934cb378f1a2557c2_JaffaCakes118 unpack001/out.upx
Files
-
0e663a2a7ebc2ba934cb378f1a2557c2_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 113KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE