Behavioral task
behavioral1
Sample
RBVG v1.1.exe
Resource
win7-20240903-en
General
-
Target
0e71103c4fdaf9ce2f6052c55c73d04e_JaffaCakes118
-
Size
8KB
-
MD5
0e71103c4fdaf9ce2f6052c55c73d04e
-
SHA1
f2e4b0b9b2fbd5399a5fdb002a69ff283b69f2f1
-
SHA256
d6dd2af26b3ca17b3d0e7937b58b194a933cb9c772bfd8df9875dc1ed8bfd522
-
SHA512
26b838b1b7f204e22598fb49a28a035052f3b2b57fb7b0066e454fcf942c4f5ee82b5b0277a273a88501d20297997cca06daa1821a5249afb142bb2cc65d8261
-
SSDEEP
192:QNA3590hP+8/kWFWHOjyEfzB0J68kXxJ2LObtL72:QNAJQ8Lu2JWBJhbB2
Malware Config
Signatures
-
resource yara_rule static1/unpack001/RBVG v1.1.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/RBVG v1.1.exe unpack002/out.upx
Files
-
0e71103c4fdaf9ce2f6052c55c73d04e_JaffaCakes118.zip
-
RBVG v1.1.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
readme.txt