Behavioral task
behavioral1
Sample
Mar..exe
Resource
win7-20240903-en
General
-
Target
0e282cae1942eab05549590c084ee0ba_JaffaCakes118
-
Size
138KB
-
MD5
0e282cae1942eab05549590c084ee0ba
-
SHA1
8a6785cb2331fe8f18ec610b0d3a5ab6eea62d8c
-
SHA256
45818d8dcc788516212c20966fa215070e98f19bc3db4fc9c127c2cc364d4ef7
-
SHA512
9f6208f7937f728efe1abd3099fd7962bd4eaeaf819a6d0feddb470dd1a7f77adb9c6c485cb9f812e5126aa7f6711f7d1b9ba2b6aa76f2ef18a0db1c84668ee6
-
SSDEEP
3072:ZrN+ikivAeG3V5SqHbn4ohe/W2dFmrZPRxwFhZj8jycfPYj/Ltt2pzrwAJ:OikkolIqHjpkddkrdRo18jRXYj/e1wAJ
Malware Config
Signatures
-
resource yara_rule static1/unpack002/Mar..exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/Mar..exe unpack003/out.upx
Files
-
0e282cae1942eab05549590c084ee0ba_JaffaCakes118.eml
-
Mar.rar.rar
-
Mar..exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 84KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 43KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
email-plain-1.txt