Behavioral task
behavioral1
Sample
e204ae7a67c863fbd54023a49a1a2fa6_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e204ae7a67c863fbd54023a49a1a2fa6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e204ae7a67c863fbd54023a49a1a2fa6_JaffaCakes118
-
Size
1.4MB
-
MD5
e204ae7a67c863fbd54023a49a1a2fa6
-
SHA1
5b408a2e1bc92bd23b8463e55d75d17254396f07
-
SHA256
155716f001784be61eb8c57bc7b7a0290adeac3dda5ca17eb2940c99df37de49
-
SHA512
441f856e0c11c1b23ac1caace36811bad1e1db84a1724facccdb5b5ed01b07bd9d7b66a1b86f1375ad7838b55b014d7201665a89e5b5b4fb5f641581767b9c82
-
SSDEEP
24576:0DtqJRZ0cZFZ6sVixG0T32PvJCVIJ9OP14UIWEsjvuqqgk17uxJmF/bOfAQmKn1o:0DoJRGc/Z6IeGgCB9OdzI7sjo17QJmcm
Malware Config
Signatures
-
resource yara_rule sample aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e204ae7a67c863fbd54023a49a1a2fa6_JaffaCakes118
Files
-
e204ae7a67c863fbd54023a49a1a2fa6_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 1.3MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 50KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 48KB - Virtual size: 136.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE