Static task
static1
Behavioral task
behavioral1
Sample
ypBNBVznebkl.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_90eb875442a3173e54855155d12d4017bdca808160ed138552615ff0c0160e1a
-
Size
443KB
-
MD5
5d9579ace11444ace785f4a3785107a9
-
SHA1
6286a6b1188e280a893509da9346ddd121ba2bfd
-
SHA256
90eb875442a3173e54855155d12d4017bdca808160ed138552615ff0c0160e1a
-
SHA512
9777650b5d32c8d00d9c43454db6dec2555f8aa205c27299baaad2f4bf49f345193e54336c402ec37b7c42a79ccda9a455fe231762d7f2f32007c7402aa38c08
-
SSDEEP
12288:f23QUb5JL6xCQI0iUXJy5BLdmMMIGAs+q6poSN0uIFtwDR:f2gu56C3KQjhFRGADD0RwN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ypBNBVznebkl.exe
Files
-
JaffaCakes118_90eb875442a3173e54855155d12d4017bdca808160ed138552615ff0c0160e1a.zip
Password: infected
-
ypBNBVznebkl.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 552KB - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ