Behavioral task
behavioral1
Sample
624017c9d7d9fa98bdec7d0edfe8dc39_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
624017c9d7d9fa98bdec7d0edfe8dc39_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
624017c9d7d9fa98bdec7d0edfe8dc39_JaffaCakes118
-
Size
128KB
-
MD5
624017c9d7d9fa98bdec7d0edfe8dc39
-
SHA1
811362996ee1590be327d989867a8949fb1e1552
-
SHA256
3d97d1364f8811cca329ed063e17ddd084bfd428fc683d7e5904f71e4f11e600
-
SHA512
bcc5066e7669c289a519fd2711f8e9fdf881145456539c5487c4aa111d1e9e0527ce5c7addffc908f18b39764e05af9019440d9ae02f416894e2d9526a2c3afd
-
SSDEEP
3072:6u42/Q+YiEDRvCmM2EYYGB7pMRmeN1Ts7oitYCYlwKcO:6t2/Q+YiEDRvC72EYYGB7+mATsl8lwKj
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/out.upx
Files
-
624017c9d7d9fa98bdec7d0edfe8dc39_JaffaCakes118.exe windows:4 windows x86 arch:x86
Code Sign
69:ea:a8:c9:64:99:5f:46:bb:82:46:dc:00:5c:3b:f3Certificate
IssuerCN=xxxNot Before24/03/2011, 12:17Not After31/12/2039, 23:59SubjectCN=xxx38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
9f:01:f1:79:bb:9e:36:0f:4f:ca:2c:5d:89:27:47:ec:3d:02:b2:5eSigner
Actual PE Digest9f:01:f1:79:bb:9e:36:0f:4f:ca:2c:5d:89:27:47:ec:3d:02:b2:5eDigest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 944KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 916KB - Virtual size: 916KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 118KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ