Behavioral task
behavioral1
Sample
c8a3851c18e4302487991c2eba99ee3e_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
c8a3851c18e4302487991c2eba99ee3e_JaffaCakes118
-
Size
183KB
-
MD5
c8a3851c18e4302487991c2eba99ee3e
-
SHA1
790b975342d87d85856adadd32f08a55b65f6f5e
-
SHA256
801e6d76f4f0116deac203ecec46d62e0e4885ef1e0f1bd39830338f5e36bd05
-
SHA512
beeb9cee6cd9da5b0cb18db4589a0c87f99b6faf2d43c7d99c2414d41399cfd568142012b041fbb652afcd3ead309970bb238b47dac35775bf065f2b9710e7e9
-
SSDEEP
3072:I99cj07rz82+vV16v9d77RoNeoykPBgnL8eaVRAlcxwqA6rEOeGphuzO:IM+rz8z16v9d77iNr7By8helcxeOeB
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource c8a3851c18e4302487991c2eba99ee3e_JaffaCakes118 unpack001/out.upx
Files
-
c8a3851c18e4302487991c2eba99ee3e_JaffaCakes118.exe windows:6 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 208KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 147KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:6 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.awekyx Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.kpkt Size: 241KB - Virtual size: 321KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsfssbi Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ