Behavioral task
behavioral1
Sample
4e19f1001b6a0225cfa5e870c12cad88_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4e19f1001b6a0225cfa5e870c12cad88_JaffaCakes118
-
Size
66KB
-
MD5
4e19f1001b6a0225cfa5e870c12cad88
-
SHA1
8b591dc120f81f324aecb58bfb5fcd6c9e51711b
-
SHA256
581a32dc4e8b858fd363e25ff550cfc23c1b90e6131df1411e76ba75ccdbf70b
-
SHA512
acbb61232d63cc0d6b219d24146f92102dbf156f1cfedb1fd0e3c6818c8dbed6025975a486d6a1c4e71ef0bb4eca94f1f203d12401fef7fbe3793b59ffbdb51e
-
SSDEEP
1536:tcSpIsWdhMz1Wi6c+0xM7WqrhLiraxUdR8lXKiw7372E:tcSpYdiz1Wi6cHxM7WqUuhw73aE
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 4e19f1001b6a0225cfa5e870c12cad88_JaffaCakes118 unpack001/out.upx
Files
-
4e19f1001b6a0225cfa5e870c12cad88_JaffaCakes118.exe windows:10 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 184KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:10 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ