Behavioral task
behavioral1
Sample
0bbe8baa423ecb2495f506f3849a1ee6_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
0bbe8baa423ecb2495f506f3849a1ee6_JaffaCakes118
-
Size
92KB
-
MD5
0bbe8baa423ecb2495f506f3849a1ee6
-
SHA1
d61ac724788f26219c537e9e0a7f3ef128332b41
-
SHA256
9d153d2cb0ddee17d30ef87d8532332df7c7984deb2525e69c97db3aa1d6eb90
-
SHA512
26e70ccf312bfed9769b77418ca3f95d2fcbdfea7a1a3119feb86cc4aa27d4e8844845b340fec398a05fe6ac15ab950760b7825a20c3158ea01a10ce457616fe
-
SSDEEP
1536:SDh+itBC/Z/I3P0HcJsXb46ubLYmUiHjCG7LjOUpfG7L2vWFCU0T1jpALbwzcCVA:O+kCh/qP0HcaXb4b/zPDJ7P+6vDTDA+w
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bbe8baa423ecb2495f506f3849a1ee6_JaffaCakes118
Files
-
0bbe8baa423ecb2495f506f3849a1ee6_JaffaCakes118.dll windows:4 windows x86 arch:x86
05c7df6d575c13faf78878f9450f3b20
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
GetProcAddress
ExitProcess
Sections
UPX0 Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX4 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX5 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX6 Size: 83KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX7 Size: 970B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE