Behavioral task
behavioral1
Sample
9485e19829ba9785dbb6ece7bae94332_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
9485e19829ba9785dbb6ece7bae94332_JaffaCakes118
-
Size
272KB
-
MD5
9485e19829ba9785dbb6ece7bae94332
-
SHA1
ee08b832406dc66c7891308d26688dcdd18ce6fe
-
SHA256
14c19c6befe9bd8a01538f0a55ed459896e6bbcfe569b11c6c55f54c7d991f74
-
SHA512
cc2b215a56f86c6c87b53bc3f2dc5199cf4c6d19e39c06866b3b7d18fbfba9340252cf8c29f533e26d54d65c7bcfd50ebb0ad8bdf19df730510ae90a4a26b45e
-
SSDEEP
6144:p/4qmDca83e+osQE8ZfIrd/ytfTJaOKAZ:V9BX8ZwZ/CJHN
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9485e19829ba9785dbb6ece7bae94332_JaffaCakes118
Files
-
9485e19829ba9785dbb6ece7bae94332_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 60KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 270KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE