Behavioral task
behavioral1
Sample
JaffaCakes118_2167c208d673b214e44648492a734001.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_2167c208d673b214e44648492a734001.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_2167c208d673b214e44648492a734001
-
Size
175KB
-
MD5
2167c208d673b214e44648492a734001
-
SHA1
b9901ba943cd433441d533c41bca8a161702ed43
-
SHA256
45384145f3d97e35b7547c2997f64e5b6be07e48fb202a9c7a5e61a64ab6fe1f
-
SHA512
4a77d5ee242ebaf116edac784c21f72108b46ee596e1f72f2a0b21d453f31bc7a70a139e1e6361619297906f0ecd983eed05770ff6f8ad9e3a5c28891f9c8626
-
SSDEEP
3072:RlQUWfkhIUy5lW7pX7/T4x7ibmQjgOIEal23BmsfpAuz1EhzxAPHn+e6YvgtBghh:QUWiEW7pr7BbmQj1Y4jfpAAEAPgooI
Malware Config
Signatures
-
Blackshades family
-
Blackshades payload 1 IoCs
resource yara_rule static1/unpack001/out.upx family_blackshades -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_2167c208d673b214e44648492a734001 unpack001/out.upx
Files
-
JaffaCakes118_2167c208d673b214e44648492a734001.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 308KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 173KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 440KB - Virtual size: 438KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ