Static task
static1
Behavioral task
behavioral1
Sample
c7efb9f41dd27d2b051e865949ac54b7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c7efb9f41dd27d2b051e865949ac54b7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c7efb9f41dd27d2b051e865949ac54b7_JaffaCakes118
-
Size
1.6MB
-
MD5
c7efb9f41dd27d2b051e865949ac54b7
-
SHA1
25261c45c452d0f259bb9aa5d2b31abfeebd637c
-
SHA256
0abe326eecd44faa6791558b4d687f80182c16a1d15118db4b42a84c61c99f68
-
SHA512
36ff73f3b819934b230f945b2bf319ce8bcd749a6f27426fbb6a9b79e0b1c420e56f37bb298a8da1dfe0c98da07223fc41d5250740edaaffcbce6d7a26557854
-
SSDEEP
24576:Y6K4YPPZpHOUn1TRP/aR7C8idp9xB7Y9+OngNjjYwCWgebNGvtdBnbmiutpPW:YYYPh0UNV/MAtY9+OgNjb9NmRKiWJ
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c7efb9f41dd27d2b051e865949ac54b7_JaffaCakes118
Files
-
c7efb9f41dd27d2b051e865949ac54b7_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
AHNLAB0 Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
AHNLAB1 Size: 1.5MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE