Behavioral task
behavioral1
Sample
274d6aa04ccf0e77be84dac42cc9cfc6_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
274d6aa04ccf0e77be84dac42cc9cfc6_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
274d6aa04ccf0e77be84dac42cc9cfc6_JaffaCakes118
-
Size
127KB
-
MD5
274d6aa04ccf0e77be84dac42cc9cfc6
-
SHA1
704b04cd8687ddc883776962cbb11846cb8b0959
-
SHA256
4c8232f695c2cdd3ac5b5a016397b76bd772f89a8d85310e20edbc82083dec25
-
SHA512
2d2af4fb7a417955c956c4a17b86ae239061b4e85115a6174c9f3458c1d50c92b30611a43241419e868fa2f425df449ba1ea3e20f88052da6514e5581dfb783b
-
SSDEEP
3072:ftowos49yjMuNxPwLmpKWbXXtWiU+2lXRyJOr6c0Iy7:fqPoMuLPIJWbnt01lXRaOl
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 274d6aa04ccf0e77be84dac42cc9cfc6_JaffaCakes118 unpack001/out.upx
Files
-
274d6aa04ccf0e77be84dac42cc9cfc6_JaffaCakes118.dll windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
UPX0 Size: - Virtual size: 200KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 123KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ