Behavioral task
behavioral1
Sample
patch.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
patch.exe
Resource
win10v2004-20240704-en
General
-
Target
2bf9c34cd9a91761464f684c096e7dbc_JaffaCakes118
-
Size
29KB
-
MD5
2bf9c34cd9a91761464f684c096e7dbc
-
SHA1
94f011c3dbbda5dac3d6ed46d4493c7dacaa3f58
-
SHA256
a3e543121ef799a72686cf7a11958bbe7dc9fe9cd007fc591f5bf1ae7938a8e1
-
SHA512
97cb366c97549e52d00cc8e342f2608ecc95d0f67b0a20aebd1a7820ecc0ef4678b46619da9acd3a151833eb86be18c3f4659ecf4e4818f0d77e67a787044f23
-
SSDEEP
768:qkEBRWYwASCuZC06X7BFOLlz3WaTqpppO5MvD8k0jd7M1uYkga:qgKyNsBFGWaUXiMb1iM1uYI
Malware Config
Signatures
-
resource yara_rule static1/unpack001/patch.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/patch.exe unpack002/out.upx
Files
-
2bf9c34cd9a91761464f684c096e7dbc_JaffaCakes118.rar
-
patch.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
下载说明.htm.html .js polyglot