Behavioral task
behavioral1
Sample
2999b5121897fe09529e2c1143711eab_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2999b5121897fe09529e2c1143711eab_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2999b5121897fe09529e2c1143711eab_JaffaCakes118
-
Size
65KB
-
MD5
2999b5121897fe09529e2c1143711eab
-
SHA1
668c9e8a7cb857abcef3ba04ba58cc0dfb44a517
-
SHA256
3ea76cf07982b10bb676d53ab28605c93f9e9b406f6cc58ba3d0d49f06f06b8d
-
SHA512
e2c8bb6d34b036405a208a539c28337402937b65d04f2d78e8b74cff058e0c818ee39c7837a67ef27997d96fe1fdc8735e4026223388054cab41327f5c542f85
-
SSDEEP
768:D1LtrCyUhAQuy14xOZOVyKVEMt6I1FL10I953FZQBH6GSsOBtUi:DDAhAQuyh4Vl//0aFZQBH6GSBUi
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2999b5121897fe09529e2c1143711eab_JaffaCakes118
Files
-
2999b5121897fe09529e2c1143711eab_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE