Behavioral task
behavioral1
Sample
0d945ffbe863ee07b1ad9b1ff7c19ac1_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
0d945ffbe863ee07b1ad9b1ff7c19ac1_JaffaCakes118
-
Size
94KB
-
MD5
0d945ffbe863ee07b1ad9b1ff7c19ac1
-
SHA1
fc1e0929761dd5bba362dde340c535546d74df0a
-
SHA256
db9e4feb018485e83e070b00f7e43c2fb551dc4bb68f5c1e0e4943a35d81a12c
-
SHA512
59ed89e0594a19283e305183687657d7b065972c838172f9e3b43f23398389a025a0ae669d7012595ae7f92b290f347dfd21a7cac080a7a1e17fd83647faa9d5
-
SSDEEP
1536:U+uL7MjVc2wJhkWnP1KsE9sgbPUURGiM7UCASF7Gye:UjmVZwJ2WPosPgzUUgiM7UEF7Gye
Malware Config
Signatures
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule sample Nirsoft -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d945ffbe863ee07b1ad9b1ff7c19ac1_JaffaCakes118
Files
-
0d945ffbe863ee07b1ad9b1ff7c19ac1_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE