Behavioral task
behavioral1
Sample
Pass_Revelator_Installation.exe
Resource
win7-20240704-en
General
-
Target
b0351c665eede12412f9ed7258265e31_JaffaCakes118
-
Size
875KB
-
MD5
b0351c665eede12412f9ed7258265e31
-
SHA1
4bf2a7e74d870a35bd7a5caf53d9a560421be3e7
-
SHA256
834f537e4b4c9d4a56ddc4102105beb063d0b9ce1c1ea6b28747b444082c205e
-
SHA512
89dc6aaf0f2667fa465921d4fbb535883966a8e341475c1f9007d82d6c223287d3dcbb4bda14f66229f7f8ecd93cee38a60b111631fda517f88d989ebbd5abd2
-
SSDEEP
24576:GFiwDTKxHUZWs+SgR6hrcrvCBl2kewcU7:GFDqhsVVhYTkl7
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Pass_Revelator_Installation.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Pass_Revelator_Installation.exe
Files
-
b0351c665eede12412f9ed7258265e31_JaffaCakes118.zip
-
Pass_Revelator_Installation.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 627KB - Virtual size: 628KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 103KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE