Behavioral task
behavioral1
Sample
trainer.exe
Resource
win7-20240704-en
General
-
Target
00ec3f29df52d017f57813471f25185a_JaffaCakes118
-
Size
49KB
-
MD5
00ec3f29df52d017f57813471f25185a
-
SHA1
53b10774bc30088b149d212dfd9dd6f5db07871c
-
SHA256
cd3b1dc23ab265e008a167a85c3f6c628a48e02229d62d1d36a8ca563bdecf0a
-
SHA512
11ecf862724c656ae77840880556251af4d00e7b6625329db25041b92faf6640af443e3c0d07c4d6ba3dd654906628156372cd5975fa3e19ab4f363a5ffd4491
-
SSDEEP
1536:/V4O2feZzhmgHi6CSeJg6J8MUKG3+nulBevfY+++lCv9:/aO2G/Hi6CS+g6JtUJqulwvfGICv9
Malware Config
Signatures
-
resource yara_rule static1/unpack001/trainer.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/trainer.exe unpack002/out.upx
Files
-
00ec3f29df52d017f57813471f25185a_JaffaCakes118.zip
-
CheMax.txt
-
readme.txt
-
trainer.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 46KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 61KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE