Behavioral task
behavioral1
Sample
Protel DXP SP2 v7.2.85.exe
Resource
win7-20240903-en
General
-
Target
38dc712b65dea0f7baa7d6120655b66a_JaffaCakes118
-
Size
14KB
-
MD5
38dc712b65dea0f7baa7d6120655b66a
-
SHA1
06718e46f2d60821afeafe2963c2788114573830
-
SHA256
a3d8a9a7487c4bcf9ce775a999381f609fa2c5c7f77fccbc50a394886ad7fdfa
-
SHA512
7e700a6e3e4cdc27562c9b1dd05e5431ac5ebe74e80648c5bc3d91e7cf70f49a2c336b2c94d921972a7f6418348cd84f4bbfada2a3b69ae85407a691eb0b748a
-
SSDEEP
384:2siUbynd6DTV60yFHrC0R+wXFJVFQz4xReI199Etw:2siUGd6DTV60yFm00IVFTrTJEtw
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Protel DXP SP2 v7.2.85.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Protel DXP SP2 v7.2.85.exe
Files
-
38dc712b65dea0f7baa7d6120655b66a_JaffaCakes118.zip
-
Protel DXP SP2 v7.2.85.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX3 Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
readme.txt