Behavioral task
behavioral1
Sample
452ba73fc963cfa1ae0eb42b074efa8d_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
452ba73fc963cfa1ae0eb42b074efa8d_JaffaCakes118
-
Size
885KB
-
MD5
452ba73fc963cfa1ae0eb42b074efa8d
-
SHA1
3ab15dfc406dc4fe1794d2f7bc6f423d5297c137
-
SHA256
719d9b6fb216879922bbbcab224e8ede3140a98b7d7bb8e83b5c467d3ec3d120
-
SHA512
ffe33c1d285c41563fe3cb973d3bc3449be37b31f8e872f1944255959a37943293071b032e2908fb27d61adb926a3db58a7fc3fbd2f4c50ded8a0595916a1201
-
SSDEEP
24576:7FE//Tct4bOsjItd3vCZr8ChhBmQkhCMt3qwMXimv:RSVjIr3vSACfBmLkMJ+Xt
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 452ba73fc963cfa1ae0eb42b074efa8d_JaffaCakes118 unpack001/out.upx -
NSIS installer 1 IoCs
resource yara_rule static1/unpack001/out.upx nsis_installer_2
Files
-
452ba73fc963cfa1ae0eb42b074efa8d_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 484KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 372KB - Virtual size: 376KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 512KB - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 159KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ