05d3f759103402d4e7a72820e11c110cc50e32e6f176140eed8ceaa506e561dd

Analysis

max time kernel
141s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:18

Target

ea91f0e304e56234e397541d87861e87_JaffaCakes118.exe
Size

239KB
MD5

ea91f0e304e56234e397541d87861e87
SHA1

7c354fa063d84aaaf919302b9971369a169dd4e1
SHA256

05d3f759103402d4e7a72820e11c110cc50e32e6f176140eed8ceaa506e561dd
SHA512

352659b22750296dd25a7925dff37fb582cfa68d87de81ee5f18f02f78a075f09324aec4bb0d2fc85ae67074554ab8024a2978b02b3b16ca81aa96f49a030f11
SSDEEP

6144:Ig/J/SfslDWrDuLGamJpedGFUvZQqn88N3sY6ZOb7f:I6J/gFqLOJEvCY8E3s

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2308-0-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2308-1-0x0000000000400000-0x000000000048C000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2308	ea91f0e304e56234e397541d87861e87_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ea91f0e304e56234e397541d87861e87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea91f0e304e56234e397541d87861e87_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
PID:2308

memory/2308-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2308-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download