Behavioral task
behavioral1
Sample
44b1e90cf2f652c125267c18e3990982_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
44b1e90cf2f652c125267c18e3990982_JaffaCakes118
-
Size
510KB
-
MD5
44b1e90cf2f652c125267c18e3990982
-
SHA1
28a383cc0abbc93381a00d73cf48b91eb35b11de
-
SHA256
dd2ea460f11aeddf1da37bf0028767965760d58e65fa6de6da569e45cc34f31d
-
SHA512
c8f48468397ebcff02048c8d7ac82d79ea77d8de6935208cacbbed6973798e3d39531fe2fd065d48834fac9ba4d8d633f99613341edfaa8fa588992009c8c8af
-
SSDEEP
12288:0YJjltrgt+SYtpYP+1JLfTbcgQLtTvDUS8pE1feY+tCIyzJRy:ZJjrgt+SYt+uTOtTQlCGYxJRy
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
44b1e90cf2f652c125267c18e3990982_JaffaCakes118.exe windows:4 windows x86 arch:x86
Code Sign
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
<�a�KyTeކ<YFUcv��qX<ڠ�NJ ����Q`W��Oq�>��]��95�5�<<HE��w3WsG�����:d EM[�T-SY�)�/�{f�,�7�~ fZ*��q!M�hw�,t���x�샓�Ϟ�� f��J���� ���S�4 �������nd����"Ss<"(��>�B������,YhMk� �a����1��ۏ~�a܉9#�]0��j�h7��X��.mI����o-[)iz�㮼���.�E�8�wU�Sѓ����s���Q�DKVϺ}�}*j�"�i\��\�S%m3s^Ti�a���� �s\N~Dc�{\:ф���WQ��'B����<XX��"� :X�l�� y�� ��3!��bN'�@eaϦ<Zp�N7Yzpbi��7�����N��oQ,ْ�?e%��f�K�D�R&���~��Gu���'����g�|a�dZ�O7����]���%<�\q��u�v�O���%�"zM�RΣi��Qǔ���j�ִTХ+~�K�|��s�]D����j�?��)����%~���b��{�AW�\�(��� 0���BsŌI���!��)�q�S�j���Mf(�R�R\���v���b�n*�N�RAd�p��%�7������G�������_��H�"�nc�9�O4���қ���Mp�m�]ܜ��k>��� �L*H��8Ĺ+ת-��:y�������f�VN�/sA���%]KrX�n�(c���T+^V���Q�h���m���nN*]���QNM��� �Z���4-/�qB�ƒ�"�nh�UKfn�ns�\\s���3t�7�az��W��"�ռK�I�^Fz�(:M9��t�t,ݚM�)�qlLѵμ��ݮ�]�'��8ˢW�lF�i�w������E�� �WC�m�i�!빴0��7�%wi������S댪@��fs�$�v��@)m�ӯޗ�1(0Dž��!,���;�[�UJ���9m�N���Ŀ5�O�F��"�:�GSpe��[���B%��7 t�A���{O70��oX��zU����$Gmrv�_КҝU��.`��n?��5����`�<zu2��ro�J�JgD�Ȝ;d�5�\��,�e::��O4��C����Ը��6�H3_�f����V[�_�ʞe�yf6ڃO>���zԔ.�*$f[����Zɒ�^K�Q>9��k�H�$�Y�u�K!P ) *�vn(KA:��;X�D�m�����W�&�i6I�Y�-&D-�C�ϕnF��c�����זm�fSt���,�C��M}(���-ܜ<ɳ�n��$O%-�CB�ؒ��N��J-/�f1��<+,�l �������5,)�6��1NH�&b�X�NN���������&c����R�t�KQ9��ͩU�6ȋ�|��3*��cl��ݐ������[�������N�R����"��e �_���ڗ��_��̗�+�Uat�H\%�5�X۱X�5p9>7�s��̯L�(S�U{Li^�#ڞ{)���O�5$�$G��[=L��kg�Oϧ3��3�����E��|���/�$�%5���K�5*����4;q8�\Y������S�ҫn��'�:�n߸˷v�d�7�z�g��"��^jՈ������3!�!�⋀�q�~��:�3I �Q��3"���~�X���;N�ʭk����W�x$���|O�m�P?�-2�j0�M �q�L쨁̴a�DJ����[p�4�T�]����_"�j��`W�I$��ϗfH�o*��B�i�v�7��[^���i+�DƺJc� yؐS��J�'����n�=��J������)���,�|S��\��S`�q��^ef��֫1F��K�FL����=�$4�@��y��g�4q<l �kyd��u.l;��8��g!X.�7��z�О��{åō�x�z�ڐJ�r��7%���?�������x��^H�d��Ӈ�&ce�i~���,�`���@�ݖi�$� ��P^��h�� �[�S�d�O������j!�{n�7wT���s�c��2(���}pSȫ��Аܯ��r�qn[{���W�l���DJ�R�"8J���D�=^.�c[~wz���>�����!����,�p���;��|��!�����ٔK�|���]5w�4�4�����!K{š�W���дbK�T�@��o��ɐ0��G�������S��� �O|�VO��Yt� ���-ף3m���ܔ�;�c���{�>�G+���yZ�����������,x�9��<Y��Ǚ����ȝ��P�3 1�+;�,����'�j���x' �Â��::uC�gLwM���&<`��3�҄[?�d�Ja�9`�y��� fxNV���� �mw����� ��}�4��>�]��i��F.��0�Ҡ��%1�[����u^SBG�[9�-��(�7�8M<��=6|��j���~@�z��b��}Swm@un���s0rH�!���.�Ɣ��Gj=v@�vt�>��M�������C4~�5.�H�P���J������l`Rg&�'}���ܕ�]�b��%�knp�!��g��І갅~�U�k���B�����H��l"�<3=SV�4O�5jV|�.��1����w�l�TKg\�7�5��c�jK?,���Wi���4jP�b|Ya�#Jw�P�Sr5D�G�Zp��٫&�[N�v^[�W��YUU�`�잙����m���C�� �̷���G����E�!����܁M���Q����j�%K�����?Rp���a/ZjkP+T���2�ˤPYɤ��1��.QN���� ���,�x�N#6��k~$�W) $�Ã����w1H��B��4��ӳ�O��x}������^1.HH�A��5�%��zN�Zd_y8&��B��'�>0�XK�}�P �dwi�U�Q�]X�>.�5��{�)Qla��#��=](��MH�4�=���Q�[� %#W^�^zZ� ��C�^ ���!�?�-Q���������<��VRm;�l�~���_����� C���!wj�@��T�ZS��Z�c�t0K�@pr�y1�8h�`�P�U>�668rY9z��RF�<���1���
Sections
UPX0 Size: 512B - Virtual size: 708KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 387KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.anti Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qwert10 Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.qwert11 Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ