Behavioral task
behavioral1
Sample
709b22b997b3a95b1f361c1ed8b04c4c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
709b22b997b3a95b1f361c1ed8b04c4c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
709b22b997b3a95b1f361c1ed8b04c4c_JaffaCakes118
-
Size
141KB
-
MD5
709b22b997b3a95b1f361c1ed8b04c4c
-
SHA1
5edc2d23743d7acaad42511584a599e41e2cc01a
-
SHA256
354d667a284a57e445f3f9dab2d00935d7f4f336e62ece24dfa62a3d2c64a53a
-
SHA512
0b50ec0464aa4e09a0661c507ef8ac0aa615d0f4917fc32a9733daa3632e592b5b5e6568799566b8a4b8ffea3bd6414b120e40ed53b2ecd95ef2652ad2e1744d
-
SSDEEP
3072:7IFF97ZSqzqQGHLxXz33XvPOmMaxP9RH3wZqO0XCnD1e5kx5bvjTSAK0KzS:sycqQG9zHvWmBOZD0eRe5Q6A5KzS
Malware Config
Signatures
-
resource yara_rule sample aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 709b22b997b3a95b1f361c1ed8b04c4c_JaffaCakes118
Files
-
709b22b997b3a95b1f361c1ed8b04c4c_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 12KB - Virtual size: 348KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 112KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE