Behavioral task
behavioral1
Sample
958492d5caf782bf876a8b898b376468_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
958492d5caf782bf876a8b898b376468_JaffaCakes118
-
Size
139KB
-
MD5
958492d5caf782bf876a8b898b376468
-
SHA1
82958cd6350e284b7c8eebbd8925bf4a97162caa
-
SHA256
c829df593d1172b83eef36bb08625b0cbe9e532e2660dd7d82ca320996d35ca8
-
SHA512
f1ff8d168830234e61ae678a3c8f1f9232d5e8c92830323d9a2c8f827adbe582e8b0f227ea9aff814d377dec4fec0688d1adc61b6d43e2d16e98111c60adba6a
-
SSDEEP
3072:zm85Xy8iAAIOb9r/X0CllKh2GaQbYS8OMIKG00D6eOBRRhrGfkQqlIPWHCsyVCvN:C8rs9r/XlGVYE7kyvWq
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/out.upx
Files
-
958492d5caf782bf876a8b898b376468_JaffaCakes118.exe windows:4 windows x86 arch:x86
Code Sign
5a:bc:cc:83:4d:a0:b3:80:40:2e:5c:b2:b4:20:37:25Certificate
IssuerCN=Root AgencyNot Before04/09/2009, 22:59Not After31/12/2039, 23:59SubjectCN=CDC,O=TaiWan Microwoman technologies inc.4f:3c:3f:24:ee:51:21:2d:49:fd:5b:be:11:19:e4:93:7b:ea:66:4aSigner
Actual PE Digest4f:3c:3f:24:ee:51:21:2d:49:fd:5b:be:11:19:e4:93:7b:ea:66:4aDigest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE