Behavioral task
behavioral1
Sample
MailCapture.exe
Resource
win7-20240903-en
General
-
Target
0ac445610afb72d5df3e3ea39099c604_JaffaCakes118
-
Size
412KB
-
MD5
0ac445610afb72d5df3e3ea39099c604
-
SHA1
5b9b60371e96bd482b217a53829c191a6e9fd21b
-
SHA256
0747deae9082fdece245f66795bb3951bf082b68da3c136a53f43f1a19af081d
-
SHA512
8398ae26369526580c3f7177ddac3d8cd22049bef594eb8249d38a6da7c3811c480124dadb2d2a59223918c0b6f5fc5f5fca4280b7862551723d36d9e0424816
-
SSDEEP
12288:ZEIR87TJwPQK3K/2eOSJhmzC7xYgOUEWVaIAiIP14v:ZPofK3FeOSJhRlR6WVayy14v
Malware Config
Signatures
-
resource yara_rule static1/unpack001/MailCapture.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MailCapture.exe
Files
-
0ac445610afb72d5df3e3ea39099c604_JaffaCakes118.rar
-
MAILCAPTURE.HLP
-
MAILCAPTURE.ini
-
MailCapture.cnt
-
MailCapture.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 740KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 355KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
history.txt
-
readme.txt