Behavioral task
behavioral1
Sample
419bfbae4996bbf39a56501131ab1da5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
419bfbae4996bbf39a56501131ab1da5_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
419bfbae4996bbf39a56501131ab1da5_JaffaCakes118
-
Size
46KB
-
MD5
419bfbae4996bbf39a56501131ab1da5
-
SHA1
f4f46210d9a9034f18c640eae7eb7ce342f2cda3
-
SHA256
e68502a29b7e46aa945931cc3eeb057a1e87455790098f5708e1f8be37562efa
-
SHA512
60d2d2822f62ad6a2e70cbddb6dd11f460b45ed8f6dc01c77809c2250f8dc09b0b2d005973f1c3d3768ed9e51b44a28608dd7526594baf6195b75889211922c7
-
SSDEEP
768:8hHYNVB3FMfe4F8XuwRN2upn7xbT3FfnU/Rt/UjhHhjHk840PDSxwC/8l2u1a+W+:w6jOJ8XPz2upndbLF1Fmh0P+Kq88u1as
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 419bfbae4996bbf39a56501131ab1da5_JaffaCakes118 unpack001/out.upx
Files
-
419bfbae4996bbf39a56501131ab1da5_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 76KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ