Behavioral task
behavioral1
Sample
29b73213309d2e36761677f2d4f4f578_JaffaCakes118.gz
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
29b73213309d2e36761677f2d4f4f578_JaffaCakes118.gz
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Rabbit.32.sys.b.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Rabbit.32.sys.b.exe
Resource
win10v2004-20241007-en
General
-
Target
29b73213309d2e36761677f2d4f4f578_JaffaCakes118
-
Size
189KB
-
MD5
29b73213309d2e36761677f2d4f4f578
-
SHA1
79de8ccccf63a13033773385131f2600bde80db8
-
SHA256
b950d8a48f6e6dce959aebf2a1bf4832f31bcfdf42bd6ad3ce20385e0746dee8
-
SHA512
623d2e196411c1c1c8747816d9367fc1fe505ec9b4786a6b9591f435d5ae80eb3162d8852c3a41c0dff1de7cc87c13bc9f035c781c4361d6dc71efa97b4bdbf3
-
SSDEEP
3072:rlJoqhOvYLURKEY96SnGMZffl+B4rtwg0YEGrbpesvJ6a8TIJW24/dmOVP0JnPEr:rE/vYYRY9RzfQ4r6P8bhka8TI0bd7VP5
Malware Config
Signatures
-
resource yara_rule static1/unpack002/Rabbit.32.sys.b.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Rabbit.32.sys.b.exe
Files
-
29b73213309d2e36761677f2d4f4f578_JaffaCakes118.gz .zip polyglot
-
sample.zip
-
Rabbit.32.sys.b.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 396KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 363KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE