Behavioral task
behavioral1
Sample
ad99ea4b7bd66aedff8aef99d5d290c6_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
ad99ea4b7bd66aedff8aef99d5d290c6_JaffaCakes118
-
Size
618KB
-
MD5
ad99ea4b7bd66aedff8aef99d5d290c6
-
SHA1
46bf435b03685182cd9aab27b71b8aab351368ba
-
SHA256
1936dd535582b04f69465bd8b52dcf2abd5c956bc2a276862e68e364739bc2ae
-
SHA512
50d6099cac8cda4c7958e32933f219ad088b0b43b665ddb62fb2342327d3096b24ee046c6fc61563b39d0411edaec920686857633f6ec1e305e0acf9c4f49d40
-
SSDEEP
6144:nS1hWUo/S89x+4mfW3PUm0aYR9YoOLsb0S6syceOsnvn3iptH3j:S1hWN/DnsW/Um0aYRKoq80Vhvn3eB3j
Malware Config
Signatures
-
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource ad99ea4b7bd66aedff8aef99d5d290c6_JaffaCakes118 unpack001/out.upx
Files
-
ad99ea4b7bd66aedff8aef99d5d290c6_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 616KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 285KB - Virtual size: 288KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 330KB - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 408KB - Virtual size: 407KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 329KB - Virtual size: 329KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ