Behavioral task
behavioral1
Sample
b58a8e1077f4d84cf4ab959007341626_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b58a8e1077f4d84cf4ab959007341626_JaffaCakes118
-
Size
129KB
-
MD5
b58a8e1077f4d84cf4ab959007341626
-
SHA1
1a556485f3b1685ba381ca7f8f2661c41b138116
-
SHA256
161fa8b487ccb64daa98c93f3bcd0a7b487a5628e7254a704ee8c35b4c7d80bf
-
SHA512
c0272859f2a2e43e4b6cb0488d8f391b972989187cbdd247be90c408b511d56247d1b7cf9801f9b2fe32a9e4a5532110fc73efe8a3e299c71367c1235fcdc3bb
-
SSDEEP
3072:T48i222ZnMMptitOVidxaEy7On8LNVusdDoR90MnuSMIiJ:T48NZMMvOOVidO7t3uCOP9Mn
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/out.upx
Files
-
b58a8e1077f4d84cf4ab959007341626_JaffaCakes118.exe windows:4 windows x86 arch:x86
Code Sign
50:e0:a5:92:ec:64:3f:b9:44:54:78:2d:4a:dd:5c:e5Certificate
IssuerCN=ngvifdfiwNot Before02/03/2011, 22:01Not After31/12/2039, 23:59SubjectCN=ngvifdfiw46:98:d9:02:c3:91:ad:b4:e6:3e:22:a1:7c:6e:11:c2:62:0e:1a:c7Signer
Actual PE Digest46:98:d9:02:c3:91:ad:b4:e6:3e:22:a1:7c:6e:11:c2:62:0e:1a:c7Digest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 9.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 121KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
DATA Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CODE Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
BSS Size: - Virtual size: 6KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ