Static task
static1
Behavioral task
behavioral1
Sample
39e0ffa7708e17689e2972e664a2ef7a_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
39e0ffa7708e17689e2972e664a2ef7a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
39e0ffa7708e17689e2972e664a2ef7a_JaffaCakes118
-
Size
1.4MB
-
MD5
39e0ffa7708e17689e2972e664a2ef7a
-
SHA1
30055fb35bf147f6adbd1f15511361a7db4719d7
-
SHA256
6f5a0ad36305e33da713a1dc81be03ae0c0833eefcdd0cdc7cf751ebcdf46a2d
-
SHA512
fbf19d1ac1dcaf7720f2e3d75b2dda1395e2ee7335f161f402073159b1de27a030e5aaa334e54b8ef6b0b61751ac4e36654867510dac2d5c4355c1eeba2a8c99
-
SSDEEP
24576:naLJ1S/Crpq/x7D4y1wMv0xTNRxJWEL+sD6QIpyyRFUqPq/pKK0u6dO34RvLbt/Y:nI00q/1YMANRxJd+sf+TRFUqy/KiOLlY
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39e0ffa7708e17689e2972e664a2ef7a_JaffaCakes118
Files
-
39e0ffa7708e17689e2972e664a2ef7a_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
AHNLAB0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
AHNLAB1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE