Behavioral task
behavioral1
Sample
NFS-CfgInstaller.exe
Resource
win7-20240903-en
General
-
Target
ddea5fda02e6c9c0a2f945834c6a7892_JaffaCakes118
-
Size
876KB
-
MD5
ddea5fda02e6c9c0a2f945834c6a7892
-
SHA1
4e020a93472514db8e8c82490a28bb943262a2af
-
SHA256
040ebea5c66de8897c1ffb5cfa22dfb658c633e5565b9d24a072a888360dd90f
-
SHA512
edb6d6a31bbba5372b65ed2958ed4d4c75fbe25475eaa20bc59d8ce9cf097f0f4b616d8484fba4e1f4c2490cb9b07109e11a8700ee3adf4a58f9e9bbef7c37cb
-
SSDEEP
24576:zRUGz3Zrf2iC3Zb1lETINdxV4JRG9g1qCl2RB:zG0pr+zpBlEEuRYvClO
Malware Config
Signatures
-
resource yara_rule static1/unpack001/NFS-CfgInstaller.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/NFS-CfgInstaller.exe unpack002/out.upx
Files
-
ddea5fda02e6c9c0a2f945834c6a7892_JaffaCakes118.rar
-
GEOMETRY.BIN
-
M3GT2.u2car
-
NFS-CfgInstaller.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 120KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 70KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
README.txt
-
SECONDARY_LOGO.dds
-
TEXTURES.BIN