Behavioral task
behavioral1
Sample
406da629b70765ed729448e790a2a1de_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
406da629b70765ed729448e790a2a1de_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
406da629b70765ed729448e790a2a1de_JaffaCakes118
-
Size
63KB
-
MD5
406da629b70765ed729448e790a2a1de
-
SHA1
67e7d25e5b806f92bf46f2d3f43e19429691e579
-
SHA256
8b9b754551cdf2500e2d6e4cac4789b905b37ee6c18e00768f41bf3b3fa62035
-
SHA512
013b83a369694294d204d8a8cb9851d8586700d66feacf0d013bb667cceb74bc5881d5da67bd87e0831c3ee94b20208eecf9c7d8fcb00e68f2c744d990615b79
-
SSDEEP
1536:ZJ4pPMfNJe8sim9FgxlIOuOOhVfNhQJRy:8lM49GlGOOhVfQJRy
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
406da629b70765ed729448e790a2a1de_JaffaCakes118.exe windows:4 windows x86 arch:x86
Code Sign
f9:c6:bb:ec:6d:2e:cf:56:36:49:96:6c:e8:a4:70:a2:9e:5b:da:b1Signer
Actual PE Digestf9:c6:bb:ec:6d:2e:cf:56:36:49:96:6c:e8:a4:70:a2:9e:5b:da:b1Digest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
P�?�/Jb�ߙW����4��$KB��B��[��%4���n������((�����F���{��\Q�/��rU37P����ƽ�,���ez$��TM VC�ԙ�����fgp�&�yh�ic�y�^���p/x����m�����I�'�t��h�/x#�%vV�l���}�ӗ!+�QG��Bx�n�U�s�A�X6B6;��5�U�l�d��S$O]KZI1��u�@��\*�__?c�Lp"u5r�P ���h��R�!��]D�ͱ����g��*bp��-���u�`b�d��v��s�g��Y����H��8�����)�1�v5Ӯ$oJ�yѷƁ�� �� �������ѕE)���O�@�/�,���(��k'�YЍ����o3�6��N���b���d��0��R����2���w�P���o:D,�k�)���~�vz·�d֜E/��^�@�)�QM�t؏$�����쓷*�cc�- ��v8��gz�VM��8{�hqA�b��� ]�#�K���7���|�k\���4�G� ���Ԝ���C�D��w�>/�6Q�����<@[�������x[�K ����<���AEn�I�l<zE��Yu��!��[�3�| 3���0��X��A�)h+��S���&כ�����'����ݰE���G�0/6y���ʂy�H ��u �*пk��jv��j:@qȨ����20��{iBȃ��1�fG�x��A���z�Р����e��G��:q홑�o��o@��C��5b�O�Ӂu�v����C�(��h6au��b�.���2�q�X� �E�eI��ģ��J�ӿ�a���a����B�F���A\�����:7����"4��;Ѽ��s1j��!kK��L��{�ݭU�����ꍺYy�.s�~��:̔�r�=�.��) ܬ!R��*�qljQ��Ĺ�?�B�Ø�_̽ ��E��ֳbc]��$U�c��Z�$y�c��͝@�/���a����y7��ԋ��8°`��<�R�>�5�P��G�`&�#ҷ��Gw��p�!��@:GatB��c!YJ�*Ȯ��<�iX��Q�*^Xc��d/0Ղ�����_=Z2�~P`]%(e�,�J���kw�֨�!��2.�Hl$ ��$���5�UǬ��×�'J���Ud�Rȡ�L,@>k=�U��5�.U�^��T�i���v�������a͡V���˂ 2xh�/��9pпo��a�@:�K2e� ��v�zk�b�@Y�����R��e�n�%�F��E> 7��ʉ��Q�].3$+����NgrQBpcy��X�����(�����,_�>���io�c�öS�����C�M�D$�v��&f�n�oxNEèw�U�%����FaU��x�QQ��m�X��]Y���n��0�Ν��EyS���[�N�����!���N?2%b.G7�q���Wc8m��4�C,���\�q7��������Vb�N7«�bHHmTR�S�E2B���Yzp��T�J�1�j��m����-�B����Ӗl �!q�Ǟ(�b����<#=�z5����DW�I�I"�-lT�ρlC��?X�1T��Y�����9���'�@����[����'���\����ĬґP2"4s�����:���k��:d�L�\U���H���nR&c&In�p��8�L�.Ƿ��Nڱ�0*P��.%��*o$2�#�=<~)�D��,ݐ*$�\���ڃ�J�!�����PiAZ��3����c��G���: �<I;G�6I����j�%9Z�s��ûM?�N���$Zb;�M��s�=RV�J�tr�Ģ��S);�׳/Y 4���5�QM�DE0gi����7@�l�!����/_O��9�Ӌ<�v ��� )ء"�'n6�Cv'�%��?���k-h�U��yZj��6���^���V >y�}�ك�Ê�nJa�$���������]i��^e`:3v���I�W���Zbs�� t��PZ�3}��� 3�<��m#�'�=s�E�����WvX�!�WU\���QV�6����s �Z��P���HZ����܊�|�+m�����sZ�$��9h��3��)o� �A�X��?� ��0q�hJHjS?����v��Vw�f���<����DNyg�ʪ���J��S]7ݮ'wX�1��q��Fq���D; ]�؇�֚|E�O=� �oa�":� �|�u7}��U���y��~xU�*ú(�J�Uw۷���,��nqT)���p#h1�ꋕ/�6��j�!ok���bޚP����hL�Q����B���)n���������\�g�j��5� �Vɬ �#��%0�RAԤ�,�0N̛���:�߅���M����3R���.,�þ���#�`%�N@�`U ܌��l������=3M� ����ͬӳh�Gp\WP�ك0�7���XDz�]��?qr�a� p"@,�/ �T����e�su�[K»�>�)' ��bn5��L����z��s�J|;1WGgȑxp�;RP�'�v��nX�DCI�`�E��P5��ݴ�l!�(82exwC�WP��@a�N;�,A�e��d�4F�N����I�-�|��2�o��B���� �O�t��.�9qB�/.B�5@͛�P��lf$��ԝ��um�T�����|Ɂޑ�t����ھʕO��'��H5'�=@y�Q!>��o����Q\+ ��B^�Գ�6x�z���W���4w0��G?|��NeDn��pMf��s�K쟕l����)��k|v{���ȣ3�1z_4-������}2L�އv��2O�o���}=�zw����4�h!8P���mMP)��r���c9���Os�ߣ� �mE9�g̾���G;αs��C� �0�����lw�S�L���sב��U27U��A��ذ$����Ŧ�rH�hQH������#|&?7�GY���|xm+w$��4�m�Bf�'���=Z���O������dY�����!�i߱~���6 �W��.!2�>���{;� Q�6nB�)W�*�R����%)��<X�(w�Z��V�E8�PCQ���]T�����h_MwƱ�L�h
Sections
UPX0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wc Size: 350B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wc Size: 425B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.anti Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bbbb0 Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bbbb1 Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ