Behavioral task
behavioral1
Sample
3b319bc6f62c7de2461d1b0499d356f4_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3b319bc6f62c7de2461d1b0499d356f4_JaffaCakes118
-
Size
46KB
-
MD5
3b319bc6f62c7de2461d1b0499d356f4
-
SHA1
f19edf638e0e5354ff4137e12dea4df640a67d87
-
SHA256
e89ec717a27f4c459e3d811029151b860ad48c54c0032449524bf52a0131e829
-
SHA512
44ed7a306036673dfdc381510b0324bb4a0b70543900ddbbdc85cc8a87bfad40c6d60805f5ac82db0560c9e85babd3f1d6b94775d1e2432b9342c7841abbbcc1
-
SSDEEP
768:t+bF8JDduEvNuJQEwrCQPusuFtDNNJxeGmvSUeGc6NlyVREujlIDGSLt0aG7QhzU:F8FJQEw2QPQpQGESi0LEuJ9SGrmW
Malware Config
Signatures
-
resource yara_rule static1/unpack001/out.upx vmprotect -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 3b319bc6f62c7de2461d1b0499d356f4_JaffaCakes118 unpack001/out.upx
Files
-
3b319bc6f62c7de2461d1b0499d356f4_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 44KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 47KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 512B - Virtual size: 438B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ