Behavioral task
behavioral1
Sample
cf13be4b3b9e4dfb952d077dbb4b36b4_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
cf13be4b3b9e4dfb952d077dbb4b36b4_JaffaCakes118
-
Size
546KB
-
MD5
cf13be4b3b9e4dfb952d077dbb4b36b4
-
SHA1
f5eacd57aaceb7a52a90266f90cfd41ac060077b
-
SHA256
d96ccbfc4d442aa3dadb88b3f124caa9140b9d6f9e23836d9074909fe89ae67e
-
SHA512
cd3001b3bc457d4cae188c3bc4f7099b5566670fbd27cb8f455f748990d6a254180c5475e1bad466d82930fdf3ad766ca29f3c0ec8f1dac5935f34457e732e50
-
SSDEEP
12288:Q37Ai11QCGOLpAn9nt1KhDCXfBlChh9cqbosv6Kqi:w7AKLLa9vKoXfBlUheqM8D3
Malware Config
Signatures
-
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource cf13be4b3b9e4dfb952d077dbb4b36b4_JaffaCakes118 unpack001/out.upx
Files
-
cf13be4b3b9e4dfb952d077dbb4b36b4_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 476KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 266KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 512KB - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ