General
-
Target
b3abb8de36ee79a99652982af2c8faf6_JaffaCakes118
-
Size
283KB
-
MD5
b3abb8de36ee79a99652982af2c8faf6
-
SHA1
e1fc979099f3b4a2debc6a56081264912869941b
-
SHA256
04ab673bc5046be8b7c5a793f225719e5aa80826e59b8ca6499c5e4f3e91132e
-
SHA512
8f6e1d428a53823a4003c8081fa22b4e35dffbb0d43b25d1fd3c38b9446d70f38c8f5fdbbeb3a9e90a3fd81d952c509659285b1d6d8c31c7a3fdd943fd63e8f2
-
SSDEEP
3072:ivnMddxxf2fCy7Ps8V3R7t0/e8E3vO5SxhAanKnHZQTAi:Kl
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b3abb8de36ee79a99652982af2c8faf6_JaffaCakes118
Files
-
b3abb8de36ee79a99652982af2c8faf6_JaffaCakes118.exe windows:10 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 236KB - Virtual size: 236KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE