Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240903-en
General
-
Target
4380ee0ef1c38f39855f39d0d5e15ce4_JaffaCakes118
-
Size
344KB
-
MD5
4380ee0ef1c38f39855f39d0d5e15ce4
-
SHA1
bf1de7f8be58d8d268fa354f8c0480d70dd3cc05
-
SHA256
2a4b8970f3af50991a995727f13f667503da2e9c557ccf850c95324321d69e79
-
SHA512
ea0dff26b3e5942851dba48bbaf5777958edebf4fc4f56497823a97e7df15c31e5fe8a38769ae81e221f8a2de1b6dbe5335b91148017113bc2400018a3f640f4
-
SSDEEP
6144:xD5JtSRWxb7CSE77Gm+S8SePoNWB8HypjY80Ylp8+zwmpN2Eo/WGF:WA6h72NFnVY8nawn2PF
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/setup.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/setup.exe unpack002/out.upx
Files
-
4380ee0ef1c38f39855f39d0d5e15ce4_JaffaCakes118.rar
-
setup.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 320KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 220KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 403KB - Virtual size: 403KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ