Behavioral task
behavioral1
Sample
alac.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
alac.exe
Resource
win10v2004-20240709-en
General
-
Target
3e2a34b5630e77e5f1c389cacf41eee5_JaffaCakes118
-
Size
28KB
-
MD5
3e2a34b5630e77e5f1c389cacf41eee5
-
SHA1
615ca10746c35142060e77c7fff7609b9737470f
-
SHA256
4bb8d39da8680a022ed6f2826cb0c2ea6546f3285c22503ed225f46444c963ff
-
SHA512
981b7d30f288e0933ff06a661765d06c2bbc3dab6aeac511c79665615e3668275400b207e5a67fe85cc08b44fea1b249d0be7334babf475977a7c3225f51340c
-
SSDEEP
768:OL33TSRwWOduVJkdoXsQK3xcIawAIAELg9pljWD/IK+:OLmRadeedWsPxVg9plWDO
Malware Config
Signatures
-
resource yara_rule static1/unpack001/alac.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/alac.exe unpack002/out.upx
Files
-
3e2a34b5630e77e5f1c389cacf41eee5_JaffaCakes118.zip
-
alac.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 28KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE