Behavioral task
behavioral1
Sample
481858a963dc03366973a9b5b38e948c_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
481858a963dc03366973a9b5b38e948c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
481858a963dc03366973a9b5b38e948c_JaffaCakes118
-
Size
90KB
-
MD5
481858a963dc03366973a9b5b38e948c
-
SHA1
e8d71f5faf509652af51d6b750f4596071f0e842
-
SHA256
a3e9c59bc76e6c00c396be6ada9eb36e2f3b499b1b74e5636c2b2395dfe64a90
-
SHA512
85d478bac08e1cf81311cc01452b58bc1e5e2ee9b3af38608d1d750d2653e1d0055e7c09230d2973851e667cf9554e5427c947bccb792713abc0f848a1d673c7
-
SSDEEP
1536:4sbzW2fYl7/UYdCJxw+EtBgw02wPxlm1MBQ229Lj/m2TkfX1UjrnmLERh3LWJ:4sPhYl78TbwPAPxlm1BR9X/m5CHnmLEO
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 481858a963dc03366973a9b5b38e948c_JaffaCakes118 unpack001/out.upx
Files
-
481858a963dc03366973a9b5b38e948c_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 164KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 89KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 172KB - Virtual size: 171KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE