Behavioral task
behavioral1
Sample
3f15ed2239d4f418cece31d98a974ac6_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3f15ed2239d4f418cece31d98a974ac6_JaffaCakes118
-
Size
93KB
-
MD5
3f15ed2239d4f418cece31d98a974ac6
-
SHA1
d31a7aed9c4b0075cca71272cc29e475339c47c6
-
SHA256
1a7644d8b695547984eb73926f68b1fd566ec1f1f0e27e5efe381404d694be91
-
SHA512
0d608ffa1e830701274893e49885d709b24f227d0204674ad59aff318db3fc739e011e4dc8361196e7c2c299e8c6dc1cdcc2c4340569592be7fd4d0dcc561f76
-
SSDEEP
1536:TIeTDD6X4IuoGLaPFNFVS1+IIhOkEZsHqGdnouy8RPObCl1dKDDN+a8R97ZzPc8m:TaX4IqMFNFVSdIhOZZwPlout6DczPc8m
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f15ed2239d4f418cece31d98a974ac6_JaffaCakes118
Files
-
3f15ed2239d4f418cece31d98a974ac6_JaffaCakes118.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX1 Size: - Virtual size: 136KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX0 Size: 49KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 43KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE