Behavioral task
behavioral1
Sample
Contrato_Ativo1507(pdf).exe
Resource
win7-20240708-en
General
-
Target
d1120ef77cecaf438ef5475506f06e0a_JaffaCakes118
-
Size
140KB
-
MD5
d1120ef77cecaf438ef5475506f06e0a
-
SHA1
511430ef32b3ca1dbc730b8639231410a9592902
-
SHA256
45096b69b523c1cb0daea7575f623006423b3a646dddae7df789e04a979ea1a2
-
SHA512
b253d51a4ce55aec9e303f188da5104da59d25145d71b8d323350c9addbcf375720e92e8f4d4ccecf5c9003ed0ed52651a7d6d68c39d0986eca1852e2d6ba70e
-
SSDEEP
3072:GOB6D944C4NzvphejMaVf/j4MmSON1B03czTvuT3Co3ZARXb:GOYD9449nYVf/m1zB03ITvwCo3ZARXb
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Contrato_Ativo1507(pdf).cmd upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Contrato_Ativo1507(pdf).cmd
Files
-
d1120ef77cecaf438ef5475506f06e0a_JaffaCakes118.zip
-
Contrato_Ativo1507(pdf).cmd.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 268KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE