Behavioral task
behavioral1
Sample
29beed02d9e57505cf5f34edf24dba1c_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
29beed02d9e57505cf5f34edf24dba1c_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
29beed02d9e57505cf5f34edf24dba1c_JaffaCakes118
-
Size
49KB
-
MD5
29beed02d9e57505cf5f34edf24dba1c
-
SHA1
12f3cb339c182bcc62a369a92db2da45aab64f5e
-
SHA256
dc64825cf0d635320d4f72e70695084faf548ded12e5daf7ebc335cad64bc1fd
-
SHA512
957a8b6cbd20e62fcef513b8a5078fb9944aa5f79d517ffa23334198d718ec0db8a33f3c2763898124f88b582a4018537fbdb35650c0f040897a328ba5b919be
-
SSDEEP
1536:Lgc2bNEdFydXdWvmznFWhj45camKZAX9:L6XNognFWhj45oOAX
Malware Config
Signatures
-
Nirsoft 1 IoCs
resource yara_rule static1/unpack001/out.upx Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule static1/unpack001/out.upx MailPassView -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 29beed02d9e57505cf5f34edf24dba1c_JaffaCakes118 unpack001/out.upx
Files
-
29beed02d9e57505cf5f34edf24dba1c_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 64KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 43KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ