Static task
static1
Behavioral task
behavioral1
Sample
Adobe.Photoshop.CS4.v11.0.Banknote.Protection.Removal-NoPE/Adobe.Photoshop.CS4.v11.0.Banknote.Protec.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Adobe.Photoshop.CS4.v11.0.Banknote.Protection.Removal-NoPE/Adobe.Photoshop.CS4.v11.0.Banknote.Protec.exe
Resource
win10v2004-20240709-en
General
-
Target
59f181c2bbcbb6ee7bd30b7f516d3bb2_JaffaCakes118
-
Size
239KB
-
MD5
59f181c2bbcbb6ee7bd30b7f516d3bb2
-
SHA1
091a037845b0329117f725bbfac5b3c51557c132
-
SHA256
7727a31d64f69aa7a15de5d9e077a3ad99c0bfec97b26e9a1ec82104814fe203
-
SHA512
282d2e97ddaad47639af6422621ad482ca9399d4cac37f355a235a077b6dd04cca50777d4ec5d52963a6d9287f84c2424786b6390a24e4f0d66a63bdda9080ec
-
SSDEEP
6144:jYnuAT+ETc5Y/2r+NG6HJMOQ1DNbkqzkvapJKleC:8bT+ECrUGX5lBzzGapJKlL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Adobe.Photoshop.CS4.v11.0.Banknote.Protection.Removal-NoPE/Adobe.Photoshop.CS4.v11.0.Banknote.Protection.Removal-NoPE/NoPE/adobe.photoshop.cs4.11.0.banknote.protection.removal-nope.exe
Files
-
59f181c2bbcbb6ee7bd30b7f516d3bb2_JaffaCakes118.zip
-
Adobe.Photoshop.CS4.v11.0.Banknote.Protection.Removal-NoPE/Adobe.Photoshop.CS4.v11.0.Banknote.Protection.Removal-NoPE/20$.jpg.jpg
-
Adobe.Photoshop.CS4.v11.0.Banknote.Protection.Removal-NoPE/Adobe.Photoshop.CS4.v11.0.Banknote.Protection.Removal-NoPE/NoPE/adobe.photoshop.cs4.11.0.banknote.protection.removal-nope.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: - Virtual size: 432KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 93KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Adobe.Photoshop.CS4.v11.0.Banknote.Protection.Removal-NoPE/Adobe.Photoshop.CS4.v11.0.Banknote.Protection.Removal-NoPE/screenshot.png.png
-
Adobe.Photoshop.CS4.v11.0.Banknote.Protection.Removal-NoPE/file_id.diz
-
Adobe.Photoshop.CS4.v11.0.Banknote.Protection.Removal-NoPE/nope.nfo
-
keygen.nfo