Behavioral task
behavioral1
Sample
2101d9e52496c9554cc1b1b1be73ac48_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2101d9e52496c9554cc1b1b1be73ac48_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2101d9e52496c9554cc1b1b1be73ac48_JaffaCakes118
-
Size
4.4MB
-
MD5
2101d9e52496c9554cc1b1b1be73ac48
-
SHA1
729a25e868b9c8709bd59c67caf9f27f82bfd303
-
SHA256
c15c736b1d9bb95d2515db1163191280640dd96753ed1294bb608f5b951f6fe5
-
SHA512
bf4f78f46a476a033cc0c67fea63db2aec6bd623553baf09d6eb5918a31af95ce645cfb6a862c46d05e0d475d2e98b386c9d4c10e133d05e1a58a24fe74e191b
-
SSDEEP
98304:l7fV4JTc5RqKVvjO6Ovo65XrxvkA+AgQtOJFKQlbYhV5UPpa4sSzwuqJdnt8pwuQ:1f0xOAeE5qaVLx/nCpXw
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 2101d9e52496c9554cc1b1b1be73ac48_JaffaCakes118 unpack001/out.upx
Files
-
2101d9e52496c9554cc1b1b1be73ac48_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 780KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 118KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 580KB - Virtual size: 576KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ