Static task
static1
Behavioral task
behavioral1
Sample
Backdoor.Win32.Popwin.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Backdoor.Win32.Popwin.exe
Resource
win10v2004-20240802-en
General
-
Target
171e2a70861d666ab0903b5773bd8acd_JaffaCakes118
-
Size
17KB
-
MD5
171e2a70861d666ab0903b5773bd8acd
-
SHA1
a6147d815cc89134a9564dd5a4f462678dd9176e
-
SHA256
8782c22aa5e9206836fe5e20ef32c9a5a1c4e2461e6ef4be9dfa3bd0a422d654
-
SHA512
bde97165b0350c2069fa3b9824a1e3aafb6ca4895781ca79bcd8f35d5dc24b026b7e8d4ed6f288c658532977e3ca748f71edb8cf938d0645e05cd574e55d1360
-
SSDEEP
384:tJuuqTfavUKPALxOk7Pl3nfmT1OT1vC2Bh5og6e+UN7jGaXr93:t0uqaPI/7P1rJvCmAepGCh3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Backdoor.Win32.Popwin.anx
Files
-
171e2a70861d666ab0903b5773bd8acd_JaffaCakes118.zip
-
Backdoor.Win32.Popwin.anx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Ro0 Size: 313B - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Ro1 Size: 18KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE