Behavioral task
behavioral1
Sample
小玩意列车时刻表.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
小玩意列车时刻表.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240226-en
General
-
Target
e7427e03f79430fe19f478c6d995cf8d_JaffaCakes118
-
Size
389KB
-
MD5
e7427e03f79430fe19f478c6d995cf8d
-
SHA1
22ea319bf1bb3e6b3812e7a5e670ad0d3d8c0b9f
-
SHA256
104af6fcfa07df88b6174bfbd176604da3aee2b9ae0b57f369cd86f078a497cb
-
SHA512
3e01472ec750ff7ddf3a2c16abe40769d991efd3c041c573a9b76ce44065cc0efd787c01c943e251d82cc46d55a627caf929bb3790b031c46453075f908e3d66
-
SSDEEP
6144:LGKt0ebqdW8Qah6zt0op5KXQcjwxNFkP4KKlKy7Ht6ZeLRtlL6uuB:qKtFbq/h6zJp5hc4N91jNOj
Malware Config
Signatures
-
resource yara_rule static1/unpack001/小玩意列车时刻表.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/小玩意列车时刻表.exe
Files
-
e7427e03f79430fe19f478c6d995cf8d_JaffaCakes118.rar
-
小玩意列车时刻表.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 676KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 372KB - Virtual size: 376KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 55KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
新云软件.url.url